11ac8b313e17391ba1c40d40d400b477bbc4bd48fc72967e308899319c9ec7bf | Triage

Analysis

max time kernel
1798s
max time network
1822s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

BotNets/The Botnet Guide.pdf
Size

1.0MB
MD5

bb70cada86476c95d30cf2fa95f8f3f2
SHA1

0cde535a11cf81b2e903941e6793f9d33c48adaf
SHA256

00c47cd5a6a69b9b0f659cc1f766c77fdef61f9fa632695a14060ac3471819d4
SHA512

0623376724a7e55decff7984b43e31d34cf3d1b6fb4add8ad81fec2d9b9c7ae3f9aff25597992a6d7d6643e21e4accf3e98cd15bee09bc31b730d7866c610718
SSDEEP

24576:mSCi2cg+M77kRMKI63upKAuLZ2VjHSfMxlJSN+TLdl:JMcXN3ceLiRxnS8Tb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1892 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1892 AcroRd32.exe
1892 AcroRd32.exe
1892 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BotNets\The Botnet Guide.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1892

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
e6b968e5b4a154f8b2a16cc425883fe4

SHA1
909c61bb526e5a65a7e65dd164f848ba938ebf77

SHA256
24d98e566ac2a89cd8e2e1172192bcab233171c36ae39b6dfd9a15c9ef4cc232

SHA512
03b2c6a866c28fef7e00d36bd2d3b4118a8e582de54e480c1bdc33cfd274b6871d152f7771c36d06c117f019d17a950ea0b7e47a6ed8274003583a0cf4efaf27

Download Submit