5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpeederXP.chm
Size 133KB
Sample240213-2ffg2aae9z
SHA256 0fa315495940fef433c72acedf5b45c4a0ae2678fcadb218807654d3fff6a090
MD5 625b7c74f73b4d550663fc03911b7bbb
SHA1 d2fdb55ac6affc11f81fcb8d440c7b11922bfd52
SHA512 e98f90ae108950a3977e422e8da2002d8fe3f08ab8c90346a25e6defc8cfa25ad9b8afa780cb2ad4e6e29ce517aa4f36e977dac73c946797c5cc18f3cd512ced
SSDEEP 3072:KRtkfrGnfF5XBp9EpGUPw5+SCzW5UQJstcxiaooOYHT/UW1ML:KRCfr2NRboS5+SCqCqxwyDML
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2448	hh.exe
2448	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\SpeederXP.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-37-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Download