7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 06:52

Sharing

Report Analysis Logs

General

Target

MemAcc.chm
Size

169KB
MD5

a147cd9e5103697e3f485786b7da195a
SHA1

f686d395b3eecf513b2e1948c5f141b1f01db761
SHA256

fa5b1f5edfb01288386ac40e18dd4eecbe8c8533e4247926889a661a53aacab9
SHA512

35fd7cc413ae02a12e292b199ce0c66756c883565f0c656763a5f58000e97d3611f1c97a7aa2c59322a135c878fb6a1e7c4d575b92e9e749669b1c3351013014
SSDEEP

3072:5TKJnIOXCxKjON7JbmWve4T6XPvOsudxTR9oGQSZlEDI7jQ:5AIOXCxK2hmgheXXidhlQSZ2DYk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

2472 hh.exe
2472 hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\MemAcc.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-19-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download