39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dcsy.chm
Size

185KB
MD5

b8d7042ddc7225d8292a0c615a3fb23b
SHA1

c6e4b822eed0682e8c1ccd75d0d30c6df0b766d0
SHA256

3003eb4f3d284477ce8eed97e07b123ae06023d441a36fb78e4b69c72d90b0c1
SHA512

4842ce823f5b7e34391febf7fe51916e1081aa8cc2ce4ea77deeb1e1bc83e2279020cee09125a7c8b08dc65035a5fb694f6177c4fe0de4524b2bc21095949605
SSDEEP

3072:/010+OC8shjxkBhaYRP+bq3UUm8N26TdIPJTqTZ9Pe1zIYSnqAlO+Stz6KnSnO:/010kt9kXnR2+EjPJOTZg17SnqES5n6O

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2240 hh.exe
2240 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2240	hh.exe
2240	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance