05cf8df596da0baa9b7e97136ca83ebcab90ca3ba3d9bdc1adc1e5cd86536ecb | Triage

Analysis

max time kernel
153s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
29-10-2021 19:15

Sharing

Report Analysis Logs

General

Target

txezwi.estn9 ybddj.obkp9 szro.qfqo9 c.ak9 mhmb9 pc.stflx.c9 ttpv.9 bigs9 afdk9 y.pnq9 lsogz.us9 uypd.pdf
Size

166KB
MD5

b976bad3ea2628a94d03afb66e7e682b
SHA1

995e35793b65adf5838b16867c165848cdcc65fc
SHA256

05cf8df596da0baa9b7e97136ca83ebcab90ca3ba3d9bdc1adc1e5cd86536ecb
SHA512

10b73f23267d358f2e41ae70c7268f2c51ee68a9f2da314a6544dcfff84264dcd35932243785111a936e971dada85e2a2863edd2ba0e8a0688c76051844e9ebc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

656 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

656 AcroRd32.exe
656 AcroRd32.exe
656 AcroRd32.exe
656 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\txezwi.estn9 ybddj.obkp9 szro.qfqo9 c.ak9 mhmb9 pc.stflx.c9 ttpv.9 bigs9 afdk9 y.pnq9 lsogz.us9 uypd.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:656

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-54-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download