8f6690984c3c2234a8fa04272e5c0791e7a5796e4565fb2011aba53b5256a721 | Triage

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-en-20211104
submitted
01-12-2021 05:25

Sharing

Report Analysis Logs

General

Target

06d21e223a68a6d8771c84255d3175eb.pdf
Size

199KB
MD5

06d21e223a68a6d8771c84255d3175eb
SHA1

1cc620cc5d54ec22a7b913d17a8940088dd5fd53
SHA256

01db44f671d5b9e2ed3ca4a7f2e9d58d9887fd28d54d5b1d531e14ba8df47f6e
SHA512

2079933c22fc802c424175e30b8085d1e1af2581c37d6a4548c8a6f021a3c767bb45996f2f67f86fd5edf77d1a904df2b16384078b13e61476244270dd36df6e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1864 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1864 AcroRd32.exe
1864 AcroRd32.exe
1864 AcroRd32.exe
1864 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\06d21e223a68a6d8771c84255d3175eb.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1864

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-55-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download