6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c

Analysis

max time kernel
68s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZealotAllideoConverter/All Video Converter/Help/Help.chm
Size

78KB
MD5

40dd514ec8952ac81046d13969c80f3b
SHA1

6143fa7ad687722aa1f7bbe9f752e46bd5c092e7
SHA256

3f3705b8647aff74c4b5c59596f28af25776afd7df754bbd42d5fb014494854d
SHA512

5ed4fd7f4d9482224fbabbf9caa3cd4401c515737812f08aa711772eaa353d429f0db64ba9c5634832e64fb55b314538f1c4bb2badbbd921493a712174f3ff79
SSDEEP

1536:t0rd1V8SwJnlavfoEthVGFTUEVqCVaJYAlkdUY:+TVg9laXoE2mCVsYFdN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	hh.exe
1668	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\Help\Help.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download