25163fdcf3c723cf4c8b987cc02bda9883d3227d528591ce6e4b8bd3576d06d6

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ezmp3c.chm
Size

24KB
MD5

ef63777091aa2f90e0d45004dbb9f4a6
SHA1

5e20b4aa3a0698720154684f001b2b98886bd672
SHA256

6159b2ad77cf7671ca38fec92714806023717dd9c2496ab32f4de101cb110ae8
SHA512

c9da5be39e809930c4d10fa4e274b373a49398d5b5da8cc57c4102fd91b2e71bcafbfd76842af38e6f892b5afbf8d8be229ed16f10df92700e483ea2e730fcdb
SSDEEP

384:kDzugNExsO9RuzGd7IBaxsFQuqpqVJzk+R1zzE3d:kDzuBsg/dcasFQu3fed

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	hh.exe
2988	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\ezmp3c.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-15-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download