597d06e44811afb2e030ccca2ae68e765ab69a08b27bc61d41f4caa7e60756c5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cladgenius.chm
Size

49KB
MD5

54606732956daa512e876c7781797d04
SHA1

3a38d3bd77d069e4128901b5566d6688df796002
SHA256

356c4c24c3ef1f3ac27dae0aad2303ca307c0c579cfd4ea01ff8057030af4f75
SHA512

c51ec7d75b504ea3da985dc6fad11b452b6a3e67594b1a7cb953e429bfe98a0eba0575049e79d01c78d3fa1e0a97b408d9f0006074270146c8d8353b8723054e
SSDEEP

768:2zQ1cg+kQZ95d2gaUzYLTMqLk4WqkBrIEm7gYP6nvFI773ZNKAokFO8Gi8+sn:2MqvZfdBlzIzkWAIE90e6PHokFVTG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	hh.exe
2788	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...