ac645fa7e24f32f31802d6d7f199757222447afc43e70968d7a67dae23c2f2b4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Z_Admin1.05/Help.chm
Size

211KB
MD5

c0fa7947cdd83bad73ecce4890ed1fc4
SHA1

bff381cd126b3a048ea51ea12bea2c5f46689c27
SHA256

2e305ccdfa8326a0350978f8387691fbfe88978e80f5b00db8de068564e139cc
SHA512

7106e6962748f879f89db5ff2f9621980c6c932addaf0f35a84254535261bfce6d398011402e49a6c16be494a4c91022a389f3c1a6efb368ea97a2dc9d0fc722
SSDEEP

3072:L/jGNaeVph4upt4yRKzBkmWXQNvAtYtzKlEf0ng08eAGLBm4vvi+A6wuzrxN6:Lr6a0ph4O2Kmm8vmYwlLXUGHvvHkuz+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	hh.exe
2680	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Z_Admin1.05\Help.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...