975930d15ab1639e8bf92f0e4de63566a0e0cadac76a5d328ebdf2337536f34f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

batchpurge/purge.chm
Size

36KB
MD5

5f99ad00797ed7274f96d0004364618d
SHA1

1f9b06e8db75f4c33e2795fe86dffa73613dddd0
SHA256

46faec6f8188af93c01624f717c84f6e3b9ebdbfedfb3eda11c314584d5c7af6
SHA512

2400381586fb026325c16ece0144d5ebabe24419ab5503ffe5cdaddc7c2efd8ae9dcf47484a6994c58d118f8db6ccaab1e3c4bd69c6c78f59667cf590012b618
SSDEEP

768:wEkzMp6Nz3UCL/tyWMJZnrlNuUwf6K31NQ0oOc9TCSMz5:wEkzMp6Nz3ZLFonnhNEf6yOjuSK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1364	hh.exe
1364	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\batchpurge\purge.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-23-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download