Analysis
-
max time kernel
141s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
01-10-2023 09:07
General
-
Target
hh.chm
-
Size
201KB
-
MD5
8dd20f3f2f25bb297c9b64895530f920
-
SHA1
87c98fe066c3424ae89f18b439cede19679076b2
-
SHA256
3317b010df0c78ddd2043dfc02a824023faba86d362627e4d42b38084134e275
-
SHA512
22713705334e69564df34938194692cb534f0c8a8be4ced34fc367aa2a7e77c96e1742b9d6ce72004c3d378fba6930fb1800a0a39985b969ced0d02d14e8d459
-
SSDEEP
6144:iTnr34RHDSWdynEzIsOcr792z8Xn5UBq0:onr3yHOiIsOcr7SOn5UU0
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies registry class 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\hh.chm1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Searches\IPU1H358nVfkU6695X1rkVVWZChGwaUvCrqH\svchost.exeFilesize
1.1MB
MD57c4bfda1e4dfa3a7c59aaeb7fee08c80
SHA17ac76bcf4a74ab57aeb62aa59531f8aad14c6c77
SHA256781609c3f08ad116aa2c342e277c4899ae760e08e6c1593f95b6aa3cf6f5b109
SHA512bd189c981a1a25c782f4c12dc00a9009a4819a33ee9eacb6c1ba30b1d656965c86099bd0beb66f1ea8cfc0bf5e7a5ddfc370b1a0fd0f69381f216e05d437d68a
-
memory/4696-6-0x00007FFEF5D90000-0x00007FFEF6851000-memory.dmpFilesize
10.8MB
-
memory/4696-7-0x000001DF73270000-0x000001DF73280000-memory.dmpFilesize
64KB
-
memory/4696-8-0x000001DF73400000-0x000001DF7357E000-memory.dmpFilesize
1.5MB
-
memory/4696-10-0x000001DF73180000-0x000001DF731B0000-memory.dmpFilesize
192KB
-
memory/4696-9-0x000001DF73AB0000-0x000001DF73FD8000-memory.dmpFilesize
5.2MB
-
memory/4696-16-0x000001DF727D0000-0x000001DF727E9000-memory.dmpFilesize
100KB
-
memory/4696-47-0x00007FFEF5D90000-0x00007FFEF6851000-memory.dmpFilesize
10.8MB
-
memory/4696-48-0x000001DF73270000-0x000001DF73280000-memory.dmpFilesize
64KB