e516e033b1f3576223933e2b6fc142677b9fbdd61308b67cfeca15eb89e8c974 | Triage

Analysis

max time kernel
4294210s
max time network
121s
platform
windows7_x64
resource
win7-20220223-en
submitted
05-03-2022 11:45

Sharing

Report Analysis Logs

General

Target

Report_Cyber-11-Legitimate_Sites_used_-as_Cobalt_Strike_C2s_against_Indian_Government.pdf
Size

3.7MB
MD5

29d40c4eebf33ca070011a30b7cf50c6
SHA1

cc810ec2d8da13a5b3e4a9cc9a0fc6bf153ce9dd
SHA256

e516e033b1f3576223933e2b6fc142677b9fbdd61308b67cfeca15eb89e8c974
SHA512

e436698f0e9530e1c5c2fc5040a20f9b52119de803c94448890ed9700b540c95bd945e7c2cdeb5a744895e412c560fe852f2d825b7775008b41bcf7638e87b79

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1788 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1788 AcroRd32.exe
1788 AcroRd32.exe
1788 AcroRd32.exe
1788 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Report_Cyber-11-Legitimate_Sites_used_-as_Cobalt_Strike_C2s_against_Indian_Government.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1788

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-54-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download