Analysis
-
max time kernel
93s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Bluetooth Suite help_HUN.chm
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Bluetooth Suite help_HUN.chm
Resource
win10v2004-20241007-en
General
-
Target
Bluetooth Suite help_HUN.chm
-
Size
63KB
-
MD5
3051a739bb5569a4740b65aa4fa59f9e
-
SHA1
4f89dee584612e3cdbbb9d766cbddeca65708058
-
SHA256
098fce4f92a83a100b0b9b65d2d44d17d2c81ac688bfc5f650e2fdfc61c73d8c
-
SHA512
7c7d5218d0cacf01defac68c9e66177305533ab269c0aa7a78b561ff1cd81b40f0a2ad91018f6e0b7eaffa7f289ced53ee34a14a8842ec79cb3d9c6501013bb1
-
SSDEEP
1536:2eV+HBqsKGpvyYsR86GHN2G2LA/He8GayXqH1w6oq3Yo:jgHVIr86uNh22He8GRXS1w6oaYo
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" hh.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\International\CpMRU hh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" hh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" hh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" hh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1424 hh.exe 1424 hh.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa