204d28a5eb5636156053d50d3173a042728de0bb57c267f8e5058cd73e409abf | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-03-2022 13:21

Sharing

Report Analysis Logs

General

Target

Users/amcdonald/AppData/Local/Microsoft/Edge/User Data/Default/Cache/Cache_Data/f_00022a.pdf
Size

66KB
MD5

b474f1b4621cee6df9cfc4553667fa33
SHA1

fa46fb8ad75ced8ea4a9a3ce84c189ad38e4287e
SHA256

3994fbb80b5af98cbb4ab211e274a3de92535e6ca107bfc0927601e707571e5a
SHA512

c2caeb2e05524dd96a8516fb3f3a2824ec5bcaae937486f981f31fd18874fdb8b0a3e9642ef8adb883aa7f3d8294bc1bbe30472f85145b8b820a570885a1820f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1848 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1848 AcroRd32.exe
1848 AcroRd32.exe
1848 AcroRd32.exe
1848 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Users\amcdonald\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00022a.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1848

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-55-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download