dbb53b0f2c9c2a6af84fb791a00540f9af056474ac067579440c80912b8f2e50

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HaoZip.chm
Size

117KB
MD5

c779ad7aca93f8b388078bb8706b6b8f
SHA1

c78f5ffd577cd02960da63c65538adde8f7a9b9a
SHA256

fa59db8421776b13aac2086ebcf3e57c9bc880ab775637ed1a76bbf600ce4adb
SHA512

c5876a07c315159243808ea60d3b89efdfc42cb1f511e2d30f066eed527bcc693b94e1462e7f7fb0f6da2e348c89a54bce1ee648152ebfbce0e976ba90d6954e
SSDEEP

3072:FKqd/2lzjE0IzKRx2QPbMqvko54BfcDwSVQyoyeG+GVA/bv:F72dA6xbPtUt+eG+G6/bv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	hh.exe
1312	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\HaoZip.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...