27ef2700f2620ce7cd09977b17b02b8e9a89b5249814ec861593dc25c23a4137 | Triage

Analysis

max time kernel
4294186s
max time network
137s
platform
windows7_x64
resource
win7-20220311-en
submitted
16-03-2022 14:50

Sharing

Report Analysis Logs

General

Target

Authorize.Net-Settlement-Payment-on-Hold.pdf
Size

20KB
MD5

b763c38140c20457f42de6251c2777d1
SHA1

fd2f020e7f56412fcba9dc0dc2a7810b7449dbaf
SHA256

e11f93fc4494181222614740f282d172f3a7a2ee48187128090b448a0d6afa33
SHA512

6cfad4d109474bbd54f5c328b2433a048e5d1097c233e4b725e7d3f2c6bf1762a378367d44e7ee2ddca9f7409d73d25edeb548ca25d830109e7a33aa44c17f94

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
1824 AcroRd32.exe
1824 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Authorize.Net-Settlement-Payment-on-Hold.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1824

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-54-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download