f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help.chm
Size

167KB
MD5

99d9d59022a7d0d798154a79781064ee
SHA1

f62891de322a58be98b657cdeb57b0aac5b32272
SHA256

d4e3243790d52524f223c0426cec7619068a04c2fc578c32d3d90fae1a3af0b2
SHA512

37c5313b855abbc43ac73e5381fc5e53b83583716b750beec8d8f37d6f247ce18ad0d0a34b4bd17260f60e314c6aaa99d6dda9800d0d6a33ed55bcee3615a452
SSDEEP

3072:ho5bBCfnitFwjQYVQUoxydFA9Z6Z4Xcv74rdkqR0HNxAoNXzCNS+:hn65+ouu9ouXcDKRRk9NXzCk+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1916	hh.exe
1916	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Help.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-18-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download