001f329a99a84175ebadb671170482baeef0338807e93f399825381e58807f37 | Triage

Analysis

max time kernel
160s
max time network
137s
platform
windows7_x64
resource
win7-en-20211208
submitted
30-01-2022 17:11

Sharing

Report Analysis Logs

General

Target

[email protected]/BMP-13.pdf
Size

3.9MB
MD5

5f5ecad862ffc50f20988a528f56937b
SHA1

b1b0ef49bf9e490662c9f42930174b1db455b658
SHA256

c81ef8dcabda564354203125dc5681ea9a7b4167feec2ce2842f01d161746e1a
SHA512

f70cbeea8b9ebf91f883cde36d374fcb55d1d2620acc82232582e27dd6d136685a917a9530569bd7f6498d3ad40908715677b6ab174165132da4e7192e270793

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1480 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1480 AcroRd32.exe
1480 AcroRd32.exe
1480 AcroRd32.exe
1480 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\[email protected]\BMP-13.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1480

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download