39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3desn.chm
Size

169KB
MD5

73bfe0abbe2128c47ead3c96521a9d70
SHA1

9780c4442a36f716be7b2da42068a7aa8f2d9356
SHA256

78ea2fedd3ef6b2847b59a8d98b371cf82ad728bac19c740a654d1e5b733cc43
SHA512

990b0c741a7166863fa966df7bcbc932d1e2925700e6e13f9fbf2c15cbd4d862f252c599d74074227cf6563a4e0e84a0a1475d88c8cca522aac423e420cbaaf5
SSDEEP

3072:7SBSORLxRgLh1GJr4pGODBnDkHNe7PEAGUSM8XT42wIhev7RDyZAROqtqCb:WEORLxmfKiZDFD9PsPrc2wIA9QLqtqk

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2352 hh.exe
2352 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2352	hh.exe
2352	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance