dbb4b94d0c47becbc462509af38fbc1a38a91809b44d318260e6a3c6e846749f

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mame32.chm
Size

115KB
MD5

a197174720acb2e0917253e6c983ddb9
SHA1

707dabc9c496239d818f57d6dcc9029350adfbe0
SHA256

ad8b509ca1471c69c052230777cd14a5ae947e9e9a2ab3553be797c3b9af80a5
SHA512

6952c3e703feee7e96e4a12e6443322e8629aa74104d806e6363d03eb79d6c9f309661d50f50257b4a526ca3b8dfdd7ef3e02fc096942686e1d25dcc9c957ab3
SSDEEP

3072:0+QtQ9EkuJDop9QuUdr2pwCGTC+0vCC0PzJYOwMsU:0+QtQif+p9QttEXh+KezJH5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	hh.exe
2852	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Mame32.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-21-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download