e9afd1d20aa0b6d2e7106f8ebd4e2cfc6b5703bb1e16d84025cf4177c35e83e4 | Triage

Analysis

max time kernel
155s
max time network
137s
platform
windows7_x64
resource
win7-en-20211014
submitted
03-11-2021 03:10

Sharing

Report Analysis Logs

General

Target

open and click xmppu9 gt.yjwhex9 hizm.j9 psgnf9 fa.um9 yqdm9 .pdf
Size

93KB
MD5

ae749af57490a25101dbaadc4a3abb96
SHA1

f3d164e61160c1be5ef8b2c96ee7ef6af7c1b4a0
SHA256

e9afd1d20aa0b6d2e7106f8ebd4e2cfc6b5703bb1e16d84025cf4177c35e83e4
SHA512

a9e67503d34621a6269e048990dc15fe3a22f2f40d16494277572d3235ea7bd987d229bbed7aa1324b42b0cf0a12c03af59760b7b2fe67c6605fd903986dae36

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

752 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

752 AcroRd32.exe
752 AcroRd32.exe
752 AcroRd32.exe
752 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\open and click xmppu9 gt.yjwhex9 hizm.j9 psgnf9 fa.um9 yqdm9 .pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-55-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download