39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dell.chm
Size

188KB
MD5

3b29ce38a2bf1d68b9e5f47b224fc208
SHA1

4b7181e8e31e220415b4014be9736a08394211ef
SHA256

d348907c412f241ba167d9b7455af4579816f43f61bc652fd2f948dfa4400904
SHA512

b7ae6fc5f4b2dd0b62dbd0ee18456fadc8381d62b5c152d71661113a3b4f12ae18302b9bb8e14f43301aa435621c7857a1ec4d6abc9edf1cd3a6e7ed0593be7d
SSDEEP

3072:h9TwViy3DBLpdJtSeqMZ84VT0Vodj6MBPtMStodn32knlhRoJyVrBt8KYaq:h9ELTBLpZSeHvVTqVXdndtoJwBt8jL

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2212 hh.exe
2212 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2212	hh.exe
2212	hh.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact