21557ee16033865aae503b34894ffac3d921f6f17a4b1f11ca926092b315fde4 | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 13:47

Sharing

Report Analysis Logs

General

Target

PassMem.chm
Size

117KB
MD5

39bc516ea5c67b140ceb2cf3d0950732
SHA1

f89ff77341529d552d9cc710538ffe9313c49b79
SHA256

e4be2244bf709df21804413c909e5472f45c0059fa043c89157d8405fa4690b8
SHA512

2b73d6f4571ad072029ec1ca23bf1f89566a2362f8d2d0c4db54afcf867a98a320209274a8ec0ac0ec6b657fd1a8709cc9b86a3f88d51820ce4a1fa987bad373
SSDEEP

3072:TIxMbqrpz4193zLZ+VcmnGp4AkphvhNdhVy5tJBUn/cg:TIqbqrpzS3XYVcl4BhNfI5FUkg

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4840	hh.exe
4840	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\PassMem.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads