bc06175ebbf0017569ad0015cbf1e44531674f2008b14e684bf4128a9797e8ed | Triage

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
04-03-2022 05:27

Sharing

Report Analysis Logs

General

Target

JNT Connect_EN-RU_Plant_CV-1.pdf
Size

104KB
MD5

b5e8caae672566f10e90f9c216ce68cd
SHA1

dcca86f4711e23054e4722266c09bbdd1e5e0108
SHA256

bc06175ebbf0017569ad0015cbf1e44531674f2008b14e684bf4128a9797e8ed
SHA512

111079588a224bc92ff4cba001d81b957b7207a5aea4220c97fade1106cca5a8450d5707822537c2a0c9e58923190433ed3ca9c2f591b85c155ae47ac72456f5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1180 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1180 AcroRd32.exe
1180 AcroRd32.exe
1180 AcroRd32.exe
1180 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JNT Connect_EN-RU_Plant_CV-1.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1180

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download