39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3desm.chm
Size

152KB
MD5

b7835b96f85d64987c6f4e3f31d839ad
SHA1

74e2d9d11cc07f7be8c973709cb706df42141d85
SHA256

4d50a06d7f04fe32378fa237a9c0ea3b352096a39115d6cd540e73ead6b3bb37
SHA512

7c542e20c5a06012eb40d2ca9afbbeb95f2ac1e7039593caa5ab56687db3efb25c4a0afc4bf03447676ac082460176450007cba86c317e0593fccce716633521
SSDEEP

3072:MTogwY4zUvyhAI0o89AO/JuT5FcPUHU6ULUu+slUv:4CrzUKhN0o8zJuT50WU3yslG

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2488 hh.exe
2488 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2488	hh.exe
2488	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance