39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dheb.chm
Size

171KB
MD5

60299a0e19fef09eafb629d7b292d9e8
SHA1

c482d3273069d9893bfaa52f3c4021e2335c1c37
SHA256

a9cde2717a6fb7eb8067cbe2546ec0c280a77cb29e78d82bad455dfb0827fe3d
SHA512

49c3f8a373f09a3748c2b1be157b419b93df2ec9f4915c93795cbc9547265bf33e53ced0699dccbecd92d607b4de8c8802a75b097277090752e8f8d355f99234
SSDEEP

3072:d8/BVSC1G6TLjqTUgy+XVb5t3eNv9vTkLe2z7vk41uxMp:ypVSq/qQa/38ueOkfG

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1624 hh.exe
1624 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1624	hh.exe
1624	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance