057b5e2d3cbd8e9224b5fb54005ccd56300d15215160a1d84f56685ba8bc5386 | Triage

Analysis

max time kernel
155s
max time network
120s
platform
windows7_x64
resource
win7-en-20211014
submitted
02-11-2021 19:10

Sharing

Report Analysis Logs

General

Target

open and click luwnddp9 qe.rw9 mwvohk.brv9 qqlrs.q9 gxtckh9 x.mj9 ufkdwq9 bq.zpn9 phcm.zuoh.9 gypw9.pdf
Size

164KB
MD5

426b349f9ce0ae0a177dec371112b139
SHA1

86cb64f2b9961966fc831f022babbdc50b6557ae
SHA256

057b5e2d3cbd8e9224b5fb54005ccd56300d15215160a1d84f56685ba8bc5386
SHA512

072696826df6b3f05fd4c94a4c76e22d6cd667f8e826593476a8b8c75a05eeda345915a288de14a431c02a0c040b2050b97c726db3f6882dbb17d2a6df2c0e73

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1116 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1116 AcroRd32.exe
1116 AcroRd32.exe
1116 AcroRd32.exe
1116 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\open and click luwnddp9 qe.rw9 mwvohk.brv9 qqlrs.q9 gxtckh9 x.mj9 ufkdwq9 bq.zpn9 phcm.zuoh.9 gypw9.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download