61d47fbfe855446d77c7da74b0b3d23dbcee4e4e48065a397bbf09a7988f596e | Triage

Analysis

max time kernel
569s
max time network
411s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 01:17

Sharing

Report Analysis Logs

General

Target

data.pdf
Size

201KB
MD5

61f85308bc4cfa27a0b49d6d3486d6a1
SHA1

af2f9e737853ac29cc9edaf2c3d837791acb0155
SHA256

61d47fbfe855446d77c7da74b0b3d23dbcee4e4e48065a397bbf09a7988f596e
SHA512

d8b2682d251818b4222faa7d14fc57f3353f386cbd56a3694993587f8018702c594a1a22dd1832f121f49805844d2871d8f9ec989696569af6cc5fef0fb1cee8
SSDEEP

6144:nDbt+BIU0MDO3Bvp1Bwm1IuAQY0LvR/cB:Dbaz1O3B31UQYQvR/o

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	984	AUDIODG.EXE
Token: 33	984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	984	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2040	AcroRd32.exe
2040	AcroRd32.exe
2040	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-55-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download