95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 16:58

Sharing

Report Analysis Logs

General

Target

cladgenius.chm
Size

29KB
MD5

dbaa4692ad7c6c55a1405fdde758381f
SHA1

8dc2a584d13730b49e84b8c411dffc6f949e04d0
SHA256

32821a96e104b7bc8280cfd4821503c396dba907cdd9d66fde9ef185cb32eebb
SHA512

a9b918ce2370cdfc3c84bd560462e8075948e13d4eb115b13b925dfb2e8edd1748b02362cf0c6ccee4723df3e104cd885d04c3c101a7dc317bd38ae8207185a1
SSDEEP

384:vyg2OYiy87TL43gJRtDUkv56t3U5bi8WMFS1D5XOYjtsTrcujbNJIo:vyyLNlDUc56WsMFSZ9pOcuj3Io

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

hh.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main hh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hh.exe

pid process

1688 hh.exe
1688 hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...