012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f | Triage

Resubmissions

19-02-2024 21:15

240219-z34f9sdh49 4

19-02-2024 21:14

240219-z3j3madc8z 4

19-02-2024 21:09

240219-zzn76sdc4x 4

19-02-2024 21:06

240219-zxwt8sdg46 4

19-02-2024 21:02

240219-zvllgsdb61 4

19-02-2024 20:38

240219-ze2mrscg61 4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 21:09

Sharing

Report Analysis Logs

General

Target

water.pdf
Size

2.2MB
MD5

9433dd42515a296d1da339ae4b5e9429
SHA1

b9547f3788105563949dc95d016350c12f429525
SHA256

012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f
SHA512

c33d949bb35cf7c3b1ff825e796fd1b08ea3132d305cdb102d3591177c45d0c26c9f5da4d4d9d5d446d962fc56bf109670f2ea8f01e9340d166f4edf2eb91062
SSDEEP

49152:XgPsLITpmtUh0Jvv+kds3MIZs1sS9Qoxak:XZITplavNfAS9Qoxak

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2452	AcroRd32.exe
2452	AcroRd32.exe
2452	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\water.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3d2fdc57d3a44b6cea488ff6e5adb4ea

SHA1
a7dbe595288637b0a443bde59185977ba99a4fc4

SHA256
602c29bba87dbf3d04841040bd929865d1b65241c7ccadbe9f33c9a5be7d71f5

SHA512
46afea1a17608082a2aaa4e3eb89ed26461bcbb02e268cd04fb87eb5d07fdb1936663a7e08f0307bf9f1d6d7dbcad0660558216ab114ad68fd49ca5de2f539d1

Download Submit