39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3d.chm
Size

120KB
MD5

b5f9ed44f46dc2a2b54baf908b9b9781
SHA1

055edb27199525f84dca0adad555b5809dc70000
SHA256

53136c96a99ec7f237470db34e49742ac99427ed6f2a22045ee9c45ce390bc69
SHA512

d2a6af6df0a945e3439cdbac94ed14e1c93c3fae4a1e3cad907835abae90d0142b04c9d10a0c4a0620178f0d9f31214a45dc864241831b2a64cef371a11a66e9
SSDEEP

3072:x3VpNumKOqLlFz0PNOsD2v8CGFM0Cbzq/bRsSohL3P1:x3Pnizg9D2UC6CUbCSaR

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2948 hh.exe
2948 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2948	hh.exe
2948	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance