7b638cf14d6a0a442ff21de012420ff235ca91818a23700a7c36e7bd50b52421 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 19:46

Sharing

Report Analysis Logs

General

Target

20063914274000/VIS2_DLL_Guider.chm
Size

151KB
MD5

d185cbca5a49c9f3e87c842aebfab981
SHA1

4442bc8045c06ba3067b7f2cc79b114d1b86a981
SHA256

60384b8280e02f8287e2077f3ce153e14526ffc00081ec4b209a25362c8f7bc9
SHA512

2a6677fc8e610bd727821e733678687406ef2d4b4fddee773d3b93fa3e5f5a0f84b753534da962e19c754bb06e842aa8a72844c434abedb81d399dda441e5d0f
SSDEEP

3072:RzH/4drHpai7ZZ+yh0FTdsr2igxsAZ2/DbqSKvMeORA:RzwZH8idwg6VkTKEw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1912 hh.exe
1912 hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\20063914274000\VIS2_DLL_Guider.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1912

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-22-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download