0fd72f6608b51192bb4bb6e6343af4cdbb44885245dab5bcaffb1578129c6c31 | Triage

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-01-2022 07:03

Sharing

Report Analysis Logs

General

Target

Fed.Hawks.14Jan22.pdf
Size

409KB
MD5

89d43e34b7e7bc4c48370cba602f458f
SHA1

f32ecd8b528a1cf2eb0370998f541cfe60ab5af3
SHA256

0fd72f6608b51192bb4bb6e6343af4cdbb44885245dab5bcaffb1578129c6c31
SHA512

0aacf109733f2ba6b2c60db22d77343484b6dbfa97974635b834752d667116fa3c43b68a2b8da84594531cc346f13afbd781b2c4214c6b00cddcf7a3354483d4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

944 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

944 AcroRd32.exe
944 AcroRd32.exe
944 AcroRd32.exe
944 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Fed.Hawks.14Jan22.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download