3c7def980dfdebc0e03d8a3d3e2ee8367268ea676050e767e3c6ad77b8f9219e | Triage

Analysis

max time kernel
4294210s
max time network
121s
platform
windows7_x64
resource
win7-20220311-en
submitted
17-03-2022 13:21

Sharing

Report Analysis Logs

General

Target

CopySwisscomstatement.pdf
Size

147KB
MD5

216fbad981ab7fc80f639466d0d05676
SHA1

0d193761ea2c3f555ab0eb3aaf0ec12380b1c5e4
SHA256

cc6ed8238063d96f5698d45f01870312e1d416e41b5baf0502eafeaf130e7c50
SHA512

15469b25b6a537d1bd20248964ebd233798cf8aaf2529bed4d4a261c985b7982f1c3a7543296c418d40d1e8227b49d9c1581bcc14ac3b8fe8c33bcfbead404cf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1216 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1216 AcroRd32.exe
1216 AcroRd32.exe
1216 AcroRd32.exe
1216 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CopySwisscomstatement.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download