a8982034b8745ca1dc3b8816b16961bf4e996c911c6411bca8530d8aea7e0610

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gross Beat.chm
Size

1.3MB
MD5

887bee4dc6c8f2640e3e21a9e7242529
SHA1

5e7632e6da6a61b9660cd9b6eecfd799d415a28f
SHA256

d6c6560a7379ea4b7e413923f12714cd3777938abdb4c5c67ebe5bc2f5ed2ce0
SHA512

f2042bcb4b1a895783647899b8e7c283784f336435f0fa6ac355e735552408c2c9d9ab23ed0b3fe8c45bceb2195795ebd0b4140386f08db3848ecae501481e89
SSDEEP

24576:a/OQ2T/gvJSEEyTELXVHNv8eLrKm/yBc/tkiw8/n81vOlce7lvI:a/fu/gsEE0+lp8e/Vae/tg8kItlvI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	hh.exe
2700	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\Gross Beat.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-26-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download