5d254ac1eb881ee492264f1d41e7c59b74275285c18b786379d94dfd175baca6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 12:05 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinTools.net Ultimate/Help/german.chm
Size

33KB
MD5

60f4a2142e05e9f9ef1d0687f340ab81
SHA1

d361d79c6a8011dd676eb6f9f377c3fc35b1bcb1
SHA256

73930fa29130562c855afa83aea1f789c64cc2bebc3360c246d24eb812647d81
SHA512

b4ab5a6ba85b9d61073bc5389dacab8b665bf86a857a6a9b57bfe8d44f392cefdac9c5c736d24a26b5b23eb539eb865353fe8b0de2cfc2df1d736cfc4527573f
SSDEEP

768:H8cLyVs0UENcF3RCQm79QXL+sdBlz4+evht73wmc:H89VYENcF3REoLvB1o7A7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	hh.exe
1880	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\Help\german.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.