5f02d11f87d53b8e02eb1a943c553c969dc80f57bad64fedd842b5607109a141

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:05

Target

EXEPackager/EXEPackager.chm
Size

110KB
MD5

b576612dd7d10152d94024535a953e6a
SHA1

af58eb9b3fb37dfa5936060b69588615836ada97
SHA256

c905b7d6dfccbbdfeff1a159d5cea122dba5404ed58a1b922442a2d5b57cc202
SHA512

5c532f81dab1f88997677a4c37355287cc50d90a732236c3742757715b1d44bb994d2010878649cea1e0e135d9562e1febbbab4a76f705d418362ccc870e8a2c
SSDEEP

1536:AB5p5qTxibtO8LA0odCk5Wd2xL495K9KFF+xH2nx9uHJCI/HLBeFzNcesvTqtACa:IUT0GNZoGL4P/FFfnx08gLsF2eaqAn8m

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1380 hh.exe
1380 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1380	hh.exe
1380	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1380-70-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download