39882128f3a30ccf40f60c9eaa228f2cd7982f0944ae63ac481bc71e58413a5c

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Target

Adobe Activator/Help/nvcpl/nv3dchs.chm
Size

159KB
MD5

c5642a52a8a562c0e877a5305c5a5845
SHA1

b29b6bbc0a369174602a67358eeea937e42f1d49
SHA256

8c46faeb2037eb7935d24c880a712e65ab970da67a856d16ff0e7e9d7cab1e07
SHA512

b5bcda70ab3cb8a9349fad02fd995071680b5dcd7b7f77647c68e27657e051e23ac373f74b17dc104ec08fefeb7a52ce3749f42af7bb6834e646a3940d64a171
SSDEEP

3072:f2heZUqskDD7PdZ09rwJMTk0eb5vBFjRczuVllbKa:fBUJD9rwJMTk0eVf9zV

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2868 hh.exe
2868 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
2868	hh.exe
2868	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance