Overview
overview
9Static
static
3VBA Recove...up.exe
windows7-x64
3VBA Recove...up.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
4Uninstall.exe
windows10-2004-x64
4VBAPass.chm
windows7-x64
1VBAPass.chm
windows10-2004-x64
1VBAPass.exe
windows7-x64
9VBAPass.exe
windows10-2004-x64
9Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
VBA Recovery Toolkit setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
VBA Recovery Toolkit setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
VBAPass.chm
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
VBAPass.chm
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
VBAPass.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
VBAPass.exe
Resource
win10v2004-20240226-en
General
- Target VBAPass.chm
- Size 23KB
- Sample240603-nbrslscd7w
- SHA256 2aab635c4be3fdb85d56d35632396d9260c69e65ea4633bfd3e3c396aa53b965
- MD5 03ab84915fbb8cff181ac17a6b09a5f3
- SHA1 a5819477b8c91a0b757841a0dcfc6fa04a8f9f33
- SHA512 92cad49e981474cff6a1169f26fbaf7146269d4843fb742ba02bfa826d6ff817df5401e4210b0e8a63370cd79c03b822018b70965cae925497abddad043244e8
- SSDEEP 384:QPfwkEVdnwPu0FQHBOdz3Z0N0Ns4n3XJPvh0moNe:QPfwkiRHBAZ0Ncs0hZ0ze
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main hh.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3000 hh.exe 3000 hh.exe