468dc2e413944b1fd4c998e54eddcc769abe3a130c05498915632e851fd240e2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help_ch.chm
Size

3.2MB
MD5

07193f62d12a310e059eda7c2398ef7c
SHA1

4b3546c24be0bf00f620bb85e7b7f1fa36708d56
SHA256

1587d90779480e0569de091991a9b7a4eb6596d5a11707b1fc76677b93474b4a
SHA512

55cd4070610b38c0cb8742e9774ca83496464066f9ee22834bcfab4f776175a5adb8b3f8f3ff8689ef70c1d87ca1afa82a93e97d64f60b3c481778dea9a679a8
SSDEEP

98304:O4Pj7i6e7qbbLPO2yNLKETTaJQdYbYXldLs:FviVGG24RaPEXldLs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	hh.exe
3048	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Help_ch.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-19-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download