39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dara.chm
Size

166KB
MD5

c1b0257579b0d16fbe0cd2d02dbfaa75
SHA1

b9e2e3ffc55508f931a9f18021b5910edaea8228
SHA256

bde3204ce98ad07f35af5a5d77cb9bcec604ae97b90a261c731e33cd86b4ec65
SHA512

dde6f5b6df6a16362bfbce8ad5467ea26e9fca5fb73d539808902b32f9f6c69a51043fb377d142a77c7d13f4f0d023c6b4dd59a173462bcf67eccee81318f05f
SSDEEP

3072:Bu6oJv2cg2QumsY2pFkMILWKqjWLSK8L2ZyWmD0fy85IMzY:Buf9ZQuzpFkMILWKtS3qBf7FU

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1812 hh.exe
1812 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1812	hh.exe
1812	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance