fd8f2b5eaeb354d4b2d73acf8f79b93ef77a353f132f8f0fa1ff094e39c4db64

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RealPlayer/Help/DFX Manual.chm
Size

196KB
MD5

9c2b548307211a9d44ac017986c12c73
SHA1

880355eeedf634376a8e3d0e801b988057e45e6c
SHA256

a755f8559649f71b530ec8545d18c65582ee255bc42174984f70119a61757692
SHA512

bc76e6e55b71f1274d7a404a3dd3c8fccf83818fbff12b8bcd3ab4d500e2523ca32217cd2e2e48a739845b850531db29b9d77d361d75e7ee20a0e639f8f8d15d
SSDEEP

6144:dh4LY9ImNtbjWTpEVIvxFaMb8l5IntRZKlmb:34LY9IYt3U2BMb8KtWlS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2208	hh.exe
2208	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\RealPlayer\Help\DFX Manual.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-21-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download