df9a20022998c7ac11af23fc69f5d42698ed187b4d03b75fa911570c648d9642 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 14:43

Sharing

Report Analysis Logs

General

Target

install/AutoIt.chm
Size

6.7MB
MD5

b107a0f9fcb0c8b61ec28855a28121c2
SHA1

e48f53eadda2dbe99af964f596fe20a261949b90
SHA256

fd415b76d4c4d1a69911ffd87401fe33e759f715b0a2e7374a25a4779f8dd1bd
SHA512

3c1c5bedad53190c2b582a80dbe50c0dfba12c0db88693fb4dae166a0fecaac12c09aac1bcf486c974ddee23d99a9adaf127cff9f974a23585d61d8e35fbe590
SSDEEP

196608:ZhJWq0n74bnORjcbd0dbb5Av+IWEt5spQst:c74qRjMd0dB4+IWU5/Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1324 hh.exe
1324 hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\install\AutoIt.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads