694a0a4c1eb0b180680efb14257b130c9235b4124053a7487d3910806f09a93c

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SciTE Jump/HelpFile.chm
Size

1.4MB
MD5

71ab458e1c380bd736eec10960a64f2d
SHA1

feafa0362779c604efd1e83bbcfd342200b5af93
SHA256

d745cbdbbc12bf3ccec0fa918e89f20196d42131fd63a14e2453c9593932daeb
SHA512

71c4006b18c68dc52f0f99ac58b7872602c6a94635978d40c520dad2bc603a28b62f2250ec3dfae7186c236b6a266c8abf979c39d86af5ff881cd3d45dccaf09
SSDEEP

24576:sZa5ZAr0cPmhJm3VlzNKr1jImBl3uN6R6ZReWGK7tx9BPM3EY8c3k:tPi0cuhJmFlzNKr1j/BEisPs3Em0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1532 hh.exe
1532 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1532	hh.exe
1532	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\SciTE Jump\HelpFile.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-26-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download