b369da8fa3af7d482c5c81e437c58388e4ab9dfe363adb16197b8c8133fb406e | Triage™

Analysis

max time kernel
100s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
09/12/2020, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase.pdf.exe
Size 648KB
Sample201209-ardkrnck2a
SHA256 b369da8fa3af7d482c5c81e437c58388e4ab9dfe363adb16197b8c8133fb406e
MD5 0a40d098f4fb7d38442aa7824cb2d01c
SHA1 7b85f753de998c8d316ba42a7463a1dba423451b
SHA512 15c4cb6c9dcc3d5af25abf97e0b808018d26e63c45a636c50842a4f858c73f488b0c7ec6b9dd907eda6797bee2df22ac1d76d8dee584776310aaf66104cf5841
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1268	AcroRd32.exe
1268	AcroRd32.exe
1268	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1268	2012	purchase.pdf.exe	26
PID 2012 wrote to memory of 1268	2012	purchase.pdf.exe	26
PID 2012 wrote to memory of 1268	2012	purchase.pdf.exe	26
PID 2012 wrote to memory of 1268	2012	purchase.pdf.exe	26

C:\Users\Admin\AppData\Local\Temp\purchase.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\purchase.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\purchase_order.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads