e3026e2bd11e4d1f35c49a32bdc24d1b29dd62394d68c51361f590ff7886e091

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tools/FSCapture/FSCaptureHelp.chm
Size

151KB
MD5

6bc96d6f2e201f037bddf72c290091be
SHA1

6f102bfc7f6724eaccdd2a35cb7c69c17d0144cb
SHA256

76cf8e8d27dd075448cf1d13e4dbf7bdbe286f1675b6c1ca4a0c10f549457804
SHA512

42d3eed5b9d074d099a2ed27ff931d2eed8c809faee718812def6d991c8f10d2601a2d80475dbb8e99f9f58d7ea8f03d306b1c67c583e1913fbbcbf1ab27e277
SSDEEP

3072:9LEq24W+xNFIVUfjhdCOi8IwYQA4WoY/0sw4e9y6nG/G/en/qTY1dz:9LEMWUMVUtdCO0FthNw42vX/6qTA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1288	hh.exe
1288	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Tools\FSCapture\FSCaptureHelp.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...