a1b14ec38a848ad3c1370bbccd6091a2ff031eb0add0441ab3d18dd80fb4a92d | Triage

Analysis

max time kernel
4294210s
max time network
121s
platform
windows7_x64
resource
win7-20220223-en
submitted
03-03-2022 20:54

Sharing

Report Analysis Logs

General

Target

strix.pdf
Size

16KB
MD5

e2e486775c8d136d268831ef0a357d9d
SHA1

d0d1f2cb14f63bce7a4d156ee1d1ebc9c8ac8d83
SHA256

a1b14ec38a848ad3c1370bbccd6091a2ff031eb0add0441ab3d18dd80fb4a92d
SHA512

686f477da697f8b964a1af49534395288fd688171652e75f8047fd94c176ed9d9c6e2a7ac5bf85b1be7725f9d9e8056f06bd5b0c77d47fee3309d72586dd6d8b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

960 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

960 AcroRd32.exe
960 AcroRd32.exe
960 AcroRd32.exe
960 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\strix.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000075CC1000-0x0000000075CC3000-memory.dmp

Filesize
8KB

Download