012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f | Triage

Resubmissions

19/02/2024, 21:15

240219-z34f9sdh49 4

19/02/2024, 21:14

240219-z3j3madc8z 4

19/02/2024, 21:09

240219-zzn76sdc4x 4

19/02/2024, 21:06

240219-zxwt8sdg46 4

19/02/2024, 21:02

240219-zvllgsdb61 4

19/02/2024, 20:38

240219-ze2mrscg61 4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 21:06

Sharing

Report Analysis Logs

General

Target

water.pdf
Size

2.2MB
MD5

9433dd42515a296d1da339ae4b5e9429
SHA1

b9547f3788105563949dc95d016350c12f429525
SHA256

012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f
SHA512

c33d949bb35cf7c3b1ff825e796fd1b08ea3132d305cdb102d3591177c45d0c26c9f5da4d4d9d5d446d962fc56bf109670f2ea8f01e9340d166f4edf2eb91062
SSDEEP

49152:XgPsLITpmtUh0Jvv+kds3MIZs1sS9Qoxak:XZITplavNfAS9Qoxak

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\water.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
88f2604546133a01c0a1733ea5ff5ba6

SHA1
7c6150b308f0683498dd4f6696f8f86f5dd92f07

SHA256
a2f0bdc7aded9cd7b65605f4098c71016cbe03aff568577558a9c59c93e910cf

SHA512
6309b1d32ef81906e157af3ce4651e2a9372d86c7542d0785cae8808057e4e686f728def954eed64b365fc694dd5680ed77dc414fe7f2b3201d133fa2e4f74be

Download Submit