e9fc3bb49743d544459e21be6786d78ad1be2576356731bc0ec3a7748b5dfbf2 | Triage

Analysis

max time kernel
151s
max time network
124s
platform
windows7_x64
resource
win7-en-20210920
submitted
29-10-2021 19:10

Sharing

Report Analysis Logs

General

Target

ykcgtnr100 fxpp.k100 dtrxq.djt100 pnmw.100 kjfg.uue100 mazr.100 odqt.dwj100 ynbps100 zh.szocpj100 k..pdf
Size

119KB
MD5

72a1314b9be7a8fdd0cff17f3db46aa0
SHA1

e5a3366869f2db027d982feda2d6a700502fc1d1
SHA256

e9fc3bb49743d544459e21be6786d78ad1be2576356731bc0ec3a7748b5dfbf2
SHA512

90ee84d3f9487337d1d1910a0aff7276a08a6ef3c2abc709a7baf88950c684c88942b4c40c97115bbf69945b25b560a62c3630e94e9c4a63be127946ceb30648

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1380 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1380 AcroRd32.exe
1380 AcroRd32.exe
1380 AcroRd32.exe
1380 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ykcgtnr100 fxpp.k100 dtrxq.djt100 pnmw.100 kjfg.uue100 mazr.100 odqt.dwj100 ynbps100 zh.szocpj100 k..pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1380

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x0000000074B41000-0x0000000074B43000-memory.dmp

Filesize
8KB

Download