39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dfra.chm
Size

171KB
MD5

b7af0f0de555f26450bebdd9f971c838
SHA1

96048e51d0a112c2d6049c8a0752430051bc5b93
SHA256

36da94c497de59e1154391f00dc08f058dbd2b4541c182f2c0abd84021d6f72c
SHA512

1c18045ed1075e22fef6cc3ca31e8736be7845111d31e42d3c2f713637e6759130c11316d95ff2086d519e791ca68e41e6ded131f5304141c642208d5814df98
SSDEEP

3072:gQ1T633ivRFRqnLA82jUqWGIww/RsvZ0UHnzfvKAL6At+dBQz/9:gQ1T6Sv9qcpjUq3fw/qNKAL6AtNz/9

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1580 hh.exe
1580 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1580	hh.exe
1580	hh.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact