33668692ad696856f95471e2b2834d75ff6ab285fe1a5d9098d340362e127454

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:10

Target

WinThruster/En.chm
Size

31KB
MD5

724cf2afeefd842a815669062aa16cb9
SHA1

3e2f911d81322f5eafe51a230b2b523880a185ec
SHA256

cd5713c1e3320de532c28b46b717fca625505022913b260ff0baf8bb89dd6e20
SHA512

16566d7140e6b9c18c9a828771db0dd1b92558d4e2f5b34e5c824f45c5114d614e943d021d801ec09f50572a7ece94cfb49f7b6a453f95331321005062221a89
SSDEEP

384:Gq9OmDIGVxnqo6UvYqBbmoZcKNbuOS1MX0jW6ciPZHRWcN/LxUkM8oJx+ob:GYSGVxqEjcKNiT1fW6p9Qc9jMnD+ob

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1048 hh.exe
1048 hh.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

pid	process
1048	hh.exe
1048	hh.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance