2a4fe31fc68d8bb5968a361288835e29ef79342088b6fd958361855f5fc4c264

Analysis

max time kernel
112s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a4fe31fc68d8bb5968a361288835e29ef79342088b6fd958361855f5fc4c264.chm
Size

64KB
MD5

7b43a9345ffe9460454cee2d17d11be7
SHA1

1b03f692104bd8c8d7ab29136c13691580868d0a
SHA256

2a4fe31fc68d8bb5968a361288835e29ef79342088b6fd958361855f5fc4c264
SHA512

43fba0a45aed7fcc08d4ef6618c6234e39724fa4f3f873858aaa080e182d0029593e8612dc00d2f904acf1d52f5cf14caf918b71589a26db07e832878b83f99d
SSDEEP

1536:pSaoW4+lpWNPqmLzAKCt/PDTR+pDnWM66P0:b4+lYNPBzHWZ3Mt8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1228	hh.exe
1228	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\2a4fe31fc68d8bb5968a361288835e29ef79342088b6fd958361855f5fc4c264.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1228-69-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download