97e64043c891792188f4b0a812edccff9e1c584e30ffd57439eed1bf16fbf8d7 | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2022 10:25

Sharing

Report Analysis Logs

General

Target

pss10r.chm
Size

392KB
MD5

54011592a20f7e581e25c393ed8a08e2
SHA1

25aacce53c9f7fbb521da79eaf213390413f6c42
SHA256

0d3a9f075e8003cd83914dde494ab3c457f68a8c8797d9060bc565c929eac515
SHA512

d88e143252e9961c3fff96d58712b0a62d8547bb605b2e66c383252c516c9be0ad4e47a58e13ee365da7ec0562c775c5abcbe8814f3f5b2e2da498fe261b1510
SSDEEP

6144:JWDGvSvzMJP0MFNZQFsI5w3IohQsEuzzH1Skh3j/A4FCR4CKK3xhk3K:JQGabxkvqw3BAeH1SkdIyazHhk3K

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

3040 hh.exe
3040 hh.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

hh.execmd.exe

description	pid	process	target process
PID 3040 wrote to memory of 1932	3040	hh.exe	cmd.exe
PID 3040 wrote to memory of 1932	3040	hh.exe	cmd.exe
PID 1932 wrote to memory of 1644	1932	cmd.exe	mshta.exe
PID 1932 wrote to memory of 1644	1932	cmd.exe	mshta.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\pss10r.chm
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start/min mshta %CD%\pss10r.chm
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\system32\mshta.exe
mshta C:\Users\Admin\AppData\Local\Temp\pss10r.chm
3⤵
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-134-0x0000000000000000-mapping.dmp

Download
memory/1932-133-0x0000000000000000-mapping.dmp

Download