3c93d8b1e69fab840a52746dc183e2bcac113cf1f05bd558a689c0bb5f24f4aa

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CADe_SIMU V4.2/Nettoplcsim-S7o-v-1-1-0-0/bin/NetToPLCsim-Manual-de.chm
Size

457KB
MD5

d154072d182820d83adad497f261ddb8
SHA1

b58281c6d178996420dd6f8f504cbb892b7c6def
SHA256

6c3dc0a9e279152a3c9738578e676d2d1757107830e64551894996db41ad512a
SHA512

0670b119fbb29a56c3b83de65267b377443ed5221fb62132ec9c805fc3badd37570880cf5738b5b07a9c6b78c17f9b9c445dd29abc6cd6f247a8b13e0d04fbaa
SSDEEP

12288:S0PNxFG31EsanesT0OX01c+dVsX4Y33psutnYUJO5O:MXeesT0vcgsPqoCO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	hh.exe
3056	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU V4.2\Nettoplcsim-S7o-v-1-1-0-0\bin\NetToPLCsim-Manual-de.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-20-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download