24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample e0b131332683… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e0b131332683…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605"],"about":{"@type":"SoftwareApplication","name":"1.chm.unknown","applicationCategory":["text","mshelp"],"identifier":"e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4dc,"window.open(location.substring(poundIndex+1));" (Indicator: "open") "var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";" (Indicator: "connect") "var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet but you might want to try to reconnect to the Internet.";" (Indicator: "connect") "var L_INTERNET_NOT_CONNECTED_TEXT = "You\u2019re not connected to a network";" (Indicator: "connect") "var L_RESOURCE_NOT_FOUND_WSAECONNRESET_TEXT = "The DNS server refused the connection.";" (Indicator: "connect") "var L_RESOURCE_NOT_FOUND_ERROR_TIMEOUT_TEXT = "The connection to the DNS server timed out.";" (Indicator: "connect") "var L_DOWNLOAD_FAILURE_TEXT = "The connection to the website was reset.";" (Indicator: "connect") "var L_CONNECTION_TIMEOUT_TEXT = "It took too long to connect to this website.";" (Indicator: "connect") "var L_DATA_NOT_AVAILABLE_TEXT = "We connected to the website but didn\u2019t receive any data from it.";" (Indicator: "connect") "var L_YOU_ARE_NOT_CONNECTED_TEXT = "You\u2019re not connected";" (Indicator: "connect") "EnableWindowNavigationInSafeMode" (Indicator: "EnableWindow") "open_or_avethl__oAtv_are_what__then_k" (Indicator: "open")26:Tcba,"hh.exe" touched "Query file associations" (Path: "HKCU\CLSID\{A07034FD-6CAA-4954-AC3F-97A27216F98A}") "hh.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "hh.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKCU\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\ELEVATION") "hh.exe" touched "PSEnumVariant" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020421-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "OutlookMessageMoniker" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002034E-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "PSTypeLib" (Path: "HKCU\CLSID\{00020423-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "PSTypeComp" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020425-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Graph Application" (Path: "HKCU\CLSID\{00020800-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Graph-Diagramm" (Path: "HKCU\CLSID\{00020803-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel 97-2003-Arbeitsblatt" (Path: "HKCU\CLSID\{00020820-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel-Diagramm" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020821-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel-Vorschau" (Path: "HKCU\CLSID\{00020827-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel-Arbeitsblatt" (Path: "HKCU\CLSID\{00020830-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel-Arbeitsblatt mit Makros" (Path: "HKCU\CLSID\{00020832-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Excel-Binrarbeitsblatt" (Path: "HKCU\CLSID\{00020833-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Word 6.0 - 7.0 Document" (Path: "HKCU\CLSID\{00020900-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Word 97-2003-Dokument" (Path: "HKCU\CLSID\{00020906-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "hh.exe" touched "Microsoft Word Picture" (Path: "HKCU\CLSID\{00020907-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}")27:T4b4,"hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\navcancl[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\ErrorPageTemplate[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\errorPageStrings[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\httpErrorPagesScripts[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\info_48[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\bullet[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\background_gradient[1]" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache"28:T528,"hh.exe" trying to access non-existent file "C:\Windows\HH.EXE.LOCAL" "hh.exe" trying to access non-existent file "C:\Windows\FLTLIB.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\hh.exe.Local\" "hh.exe" trying to access non-existent file "C:\Windows\URLMON.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\urlmon.dll" "hh.exe" trying to access non-existent file "C:\Windows\CRYPTBASE.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\CRYPTBASE.DLL" "hh.exe" trying to access non-existent file "C:\Windows\CLDAPI.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\CLDAPI.dll" "hh.exe" trying to access non-existent file "C:\Windows\AEPIC.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\AEPIC.dll" "hh.exe" trying to access non-existent file "C:\Windows\MSISO.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\msIso.dll" "hh.exe" trying to access non-existent file "C:\Windows\PROPSYS.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\PROPSYS.dll" "hh.exe" trying to access non-existent file "C:\Windows\SSPICLI.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\SspiCli.dll" "hh.exe" trying to access non-existent file "C:\Windows\MSHTML.DLL" "hh.exe" trying to access non-existent file "C:\WINDOWS\MSHTML.dll"29:T2da5," function isExternalUrlSafeForNavigation(urlStr) { var regEx = new RegExp("^(http(s?)|ftp|file)://", "i"); return regEx.exec(urlStr); } function clickRefresh() { var location = window.location.href; var poundIndex = location.indexOf('#'); if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1))) { window.location.replace(location.substring(poundIndex+1)); } } function navCancelInit() { var location = window.location.href; var poundIndex = location.indexOf('#'); if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1))) { var bElement = document.createElement("A"); bElement.innerText = L_REFRESH_TEXT; bElement.href = 'javascript:clickRefresh()'; navCancelContainer.appendChild(bElement); } else { var textNode = document.createTextNode(L_RELOAD_TEXT); navCancelContainer.appendChild(textNode); } } function getDisplayValue(elem) { var objStyle; if (window.getComputedStyle) { objStyle = window.getComputedStyle(elem); } else { objStyle = elem.currentStyle; } return objStyle.display; } function expandCollapse(elem, changeImage) { if (document.getElementById) { ecBlock = document.getElementById(elem); if (ecBlock != undefined && ecBlock != null) { if (changeImage) { elemImage = document.getElementById(elem + "Image"); } if (!changeImage || (elemImage != undefined && elemImage != null)) { var displayValue = getDisplayValue(ecBlock); if (displayValue == "none" || displayValue == null || displayValue == "") { ecBlock.style.display = "block"; if (changeImage) { elemImage.src = "up.png"; } } else if (displayValue == "block") { ecBlock.style.display = "none"; if (changeImage) { elemImage.src = "down.png"; } } else { ecBlock.style.display = "block"; if (changeImage) { elemImage.src = "up.png"; } } } } } } function initHomepage() { DocURL=document.location.href; var poundIndex = DocURL.indexOf('#'); if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1))) { protocolIndex=DocURL.indexOf("://", 4); serverIndex=DocURL.indexOf("/", protocolIndex + 3); BeginURL=DocURL.indexOf("#",1) + 1; urlresult=DocURL.substring(BeginURL, serverIndex); if (protocolIndex - BeginURL > 7) urlresult=""; displayresult=DocURL.substring(protocolIndex + 3, serverIndex); } else { displayresult = ""; urlresult = ""; } var aElement = document.createElement("A"); aElement.innerText = displayresult; aElement.href = urlresult; homepageContainer.appendChild(aElement); } function initConnectionStatus() { if (navigator.onLine) { checkConnection.innerText = L_CONNECTION_ON_TEXT; } else { checkConnection.innerText = L_CONNECTION_OFF_TEXT; } } function initGoBack() { if (history.length < 1) { var textNode = document.createTextNode(L_GOBACK_TEXT); goBackContainer.appendChild(textNode); } else { var bElement = document.createElement("A"); bElement.innerText = L_GOBACK_TEXT ; bElement.href = "javascript:history.back();"; goBackContainer.appendChild(bElement); } } function initMoreInfo(infoBlockID) { var bElement = document.createElement("A"); bElement.innerText = L_MOREINFO_TEXT; bElement.href = "javascript:expandCollapse(\'infoBlockID\', true);"; moreInfoContainer.appendChild(bElement); } function initOfflineUser(offlineUserID) { var bElement = document.createElement("A"); bElement.innerText = L_OFFLINE_USERS_TEXT; bElement.href = "javascript:expandCollapse('offlineUserID', true);"; offlineUserContainer.appendChild(bElement); } function initUnframeContent() { var location = window.location.href; var poundIndex = location.indexOf('#'); if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1))) { document.getElementById("whatToDoIntro").style.display=""; document.getElementById("whatToDoBody").style.display=""; } } function removeNoScriptElements() { var noScriptElements = document.getElementsByTagName("noscript"); for (var i = noScriptElements.length - 1; i >= 0; i--) { var bElement = noScriptElements[i]; if (bElement !== undefined && bElement !== null) { bElement.parentNode.removeChild(bElement); } } } function makeNewWindow() { var location = window.location.href; var poundIndex = location.indexOf('#'); if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1))) { window.open(location.substring(poundIndex+1)); } } function setTabInfo(tabInfoBlockID) { var bPrevElement = document.getElementById("tabInfoTextID"); var bPrevImage = document.getElementById("tabInfoBlockIDImage"); if (bPrevElement != null) { tabInfoContainer.removeChild(bPrevElement); } if (bPrevImage != null) { tabImageContainer.removeChild(bPrevImage); } var bElement = document.createElement("A"); var bImageElement = document.createElement("IMG"); var ecBlock = document.getElementById(tabInfoBlockID); if ((ecBlock != undefined && ecBlock != null) && (getDisplayValue(ecBlock) == "none" || getDisplayValue(ecBlock) == null || getDisplayValue(ecBlock) == "")) { bElement.innerText = L_SHOW_HOTKEYS_TEXT; bImageElement.alt = L_SHOW_HOTKEYS_TEXT; bImageElement.src="down.png"; } else { bElement.innerText = L_HIDE_HOTKEYS_TEXT; bImageElement.alt = L_HIDE_HOTKEYS_TEXT; bImageElement.src="up.png"; } bElement.id = "tabInfoTextID"; bElement.href = "javascript:expandCollapse(\'tabInfoBlockID\', false); setTabInfo('tabInfoBlockID');"; bImageElement.id="tabInfoBlockIDImage"; bImageElement.border="0"; bImageElement.className="actionIcon"; tabInfoContainer.appendChild(bElement); tabImageContainer.appendChild(bImageElement); } function launchInternetOptions() { window.external.msLaunchInternetOptions(); } function diagnoseConnection() { window.external.DiagnoseConnection(); } function diagnoseConnectionAndRefresh() { window.external.DiagnoseConnection(); if (navigator.onLine) { clickRefresh(); } } function getInfo() { checkConnection(); if (document.addEventListener) { addEventListener("offline", reportConnectionEvent, false); } else { attachEvent("onoffline", reportConnectionEvent); } document.body.ononline = reportConnectionEvent; document.body.onoffline = reportConnectionEvent; } function checkConnection() { var newHeading = document.getElementById("mainTitle"); var notConnectedTasks = document.getElementById("notConnectedTasks"); var cantDisplayTasks = document.getElementById("cantDisplayTasks"); if (navigator.onLine) { document.title = L_INTERNET_CONNECTED_TEXT; newHeading.textContent = L_INTERNET_CONNECTED_TEXT; addURL(); getErrorStatus(); notConnectedTasks.style.display = "none"; cantDisplayTasks.style.display = ""; } else { document.title = L_INTERNET_NOT_CONNECTED_TEXT; newHeading.textContent = L_INTERNET_NOT_CONNECTED_TEXT; notConnectedTasks.style.display = ""; cantDisplayTasks.style.display = "none"; } } function reportConnectionEvent(e) { if (!e) e = window.event; if ('online' == e.type) { setTimeout ( "clickRefresh()", 1000 ); } else if ('offline' == e.type) { checkConnection(); } else { checkConnection(); } } function addURL() { var urlResult = ""; var DocURL = document.location.href; var urlPlaceholder = document.getElementById("webpage"); var beginIndex = DocURL.indexOf('#') + 1; if (DocURL.indexOf("file://", beginIndex) == -1) { var protocolEndIndex = DocURL.indexOf("://", beginIndex); var endIndex=DocURL.indexOf("/", protocolEndIndex + 3); urlResult = DocURL.substring(beginIndex, endIndex); urlPlaceholder.innerText = urlResult + " "; var cantDisplayTasks = document.getElementById("cantDisplayTasks"); if (cantDisplayTasks) { var searchTask = document.getElementById("task1-2"); var searchString = searchTask.innerText; var bingLink = document.createElement("a"); bingLink.href = "https://www.bing.com/search?q=" + encodeURIComponent(urlResult) + "&PC=IENEPB"; bingLink.innerHTML = searchString; searchTask.innerHTML = ""; searchTask.appendChild(bingLink); } } } function addDomainName() { var domainNamePlaceholder = document.getElementById("DomainName"); domainNamePlaceholder.innerText = findValue("DomainName=") + " "; } function addProxyDetail() { var proxyDetailPlaceholder = document.getElementById("ProxyDetail"); proxyDetailPlaceholder.innerText = findValue("ProxyDetail="); } function findValue(key) { var value = ''; DocQuery = document.URL; BeginString = DocQuery.indexOf(key); if (BeginString > 0) { BeginString += key.length; var ampLocation = DocQuery.indexOf("&", BeginString); var poundLocation = DocQuery.indexOf("#", BeginString); var EndString = 0; if (ampLocation > 0 && poundLocation > 0) { EndString = Math.min(ampLocation, poundLocation); } else if (ampLocation > 0) { EndString = ampLocation; } else if (poundLocation > 0) { EndString = poundLocation; } if (EndString > 0) { value = DocQuery.substring(BeginString, EndString); } else { value = DocQuery.substring(BeginString); } } return value; } function isHTTPS(cantDisplayTasks) { var DocURL = document.location.href; var poundIndex = DocURL.indexOf('#'); var protocolIndex = DocURL.indexOf("https://", poundIndex); if (protocolIndex>poundIndex) { var bElement = document.createElement("li"); bElement.textContent = L_TLS_SSL_TEXT; cantDisplayTasks.appendChild(bElement); } } function getErrorStatus() { var errorStatus = findValue("ErrorStatus="); if (errorStatus) { var errorCode = ""; var subError = document.getElementById("subError"); var errorCodes = { "0x800C0008": { name: "INET_E_DOWNLOAD_FAILURE", description: L_DOWNLOAD_FAILURE_TEXT }, "0x800C0014": { name: "INET_E_REDIRECT_FAILED", description: L_REDIRECT_FAILED_TEXT }, "0x800C000B": { name: "INET_E_CONNECTION_TIMEOUT", description: L_CONNECTION_TIMEOUT_TEXT }, "0x800C0007": { name: "INET_E_DATA_NOT_AVAILABLE", description: L_DATA_NOT_AVAILABLE_TEXT }, "0x800C0004": { name: "INET_E_CANNOT_CONNECT", description: null }, "0x800C000E": { name: "INET_E_SECURITY_PROBLEM", description: null }, "0x800C0006": { name: "INET_E_OBJECT_NOT_FOUND", description: null }, "0x800C0002": { name: "INET_E_INVALID_URL", description: null } }; var ERROR_SUCCESS = 0; var WSAECONNRESET = 10054; var ERROR_TIMEOUT = 1460; var DNS_ERROR_RCODE_NAME_ERROR = 9003; var INET_E_RESOURCE_NOT_FOUND = "0x800C0005"; if (errorStatus === INET_E_RESOURCE_NOT_FOUND) { errorCode = "INET_E_RESOURCE_NOT_FOUND"; var dnsString = findValue("DNSError="); if (dnsString) { var dnsStatus = Number(dnsString); if (dnsStatus === WSAECONNRESET) { errorString = L_RESOURCE_NOT_FOUND_WSAECONNRESET_TEXT; } else if (dnsStatus === ERROR_TIMEOUT) { errorString = L_RESOURCE_NOT_FOUND_ERROR_TIMEOUT_TEXT; } else if (dnsStatus === ERROR_SUCCESS) { errorString = L_RESOURCE_NOT_FOUND_ERROR_SUCCESS_TEXT; } else if (dnsStatus === DNS_ERROR_RCODE_NAME_ERROR) { errorString = L_RESOURCE_NOT_FOUND_RCODE_NAME_ERROR_TEXT; } else { errorString = L_RESOURCE_NOT_FOUND_ERROR_OTHER_TEXT; } } else { errorString = L_RESOURCE_NOT_FOUND_TEXT; } document.getElementById("ErrorCode").innerHTML = L_ERROR_CODE_TEXT + errorCode; subError.innerHTML = errorString + "
"; } else if (errorStatus in errorCodes) { var error = errorCodes[errorStatus]; document.getElementById("ErrorCode").innerHTML = L_ERROR_CODE_TEXT + error.name; if (error.description) { subError.innerHTML = error.description + "
"; } } } } function checkTLSError() { var protocolSettings = Number(findValue("SecureProtocol=")); var defaultSettings = 2688; if (protocolSettings !== defaultSettings) { document.getElementById("subError").innerHTML += "

" + L_NONDEFAULT_SETTINGS_TEXT; document.getElementById("internetOptions").className = document.getElementById("internetOptions").className.replace(/(?:^|\s)hidden(?!\S)/g, ''); } }" (Indicator: "https://")2a:Tc7a,"hh.exe" wrote bytes "6012e5befa7f0000" to virtual address "0xC1644020" (part of module "GDI32.DLL") "hh.exe" wrote bytes "704245c1fa7f0000003e45c1fa7f0000" to virtual address "0xBEB545B0" (part of module "KERNELBASE.DLL") "hh.exe" wrote bytes "202eecbdfa7f0000302eecbdfa7f0000" to virtual address "0xBF3F8378" (part of module "COMBASE.DLL") "hh.exe" wrote bytes "f0e51dbffa7f0000a0ff1dbffa7f0000" to virtual address "0xC14261C8" (part of module "IMM32.DLL") "hh.exe" wrote bytes "e93efafc09" to virtual address "0xB79C1010" ("NetWkstaGetInfo@NETAPI32.DLL") "hh.exe" wrote bytes "a02decbdfa7f00002033ecbdfa7f0000102eecbdfa7f0000802fecbdfa7f0000" to virtual address "0xB615E198" (part of module "IERTUTIL.DLL") "hh.exe" wrote bytes "90c468c1fa7f0000e0bc68c1fa7f0000e0bf68c1fa7f0000" to virtual address "0xBF3F80F0" (part of module "COMBASE.DLL") "hh.exe" wrote bytes "a01c46c1fa7f0000601c46c1fa7f0000d01b46c1fa7f0000" to virtual address "0xBF3F8430" (part of module "COMBASE.DLL") "hh.exe" wrote bytes "a09de6befa7f0000608ee6befa7f000090b7e4befa7f0000a090e6befa7f0000508de4befa7f0000502ee4befa7f000020c4e6befa7f000070bbe6befa7f000080bce6befa7f00004078e7befa7f0000a0bae6befa7f00000088e6befa7f0000" to virtual address "0xC1644030" (part of module "GDI32.DLL") "hh.exe" wrote bytes "30c0e7befa7f000020c0e7befa7f000000b8e7befa7f0000c09ee6befa7f0000d0a1e6befa7f000090bae6befa7f000080baecbefa7f000080a2e7befa7f0000603de4befa7f00004023ebbefa7f0000" to virtual address "0xC16452B0" (part of module "GDI32.DLL") "hh.exe" wrote bytes "f0c0e6befa7f000030eae9befa7f0000303fe4befa7f00001024eabefa7f00009080e4befa7f0000c04be4befa7f00008024eabefa7f00006072e7befa7f000030f2e4befa7f00008005e6befa7f0000" to virtual address "0xC1644270" (part of module "GDI32.DLL") "hh.exe" wrote bytes "c0ce4dbffa7f0000005050bffa7f0000c07c50bffa7f0000c0f24dbffa7f0000" to virtual address "0xBEB54320" (part of module "KERNELBASE.DLL") "hh.exe" wrote bytes "90134fbffa7f000000494ebffa7f000050714ebffa7f0000f0014fbffa7f0000" to virtual address "0xBEB542E0" (part of module "KERNELBASE.DLL") "hh.exe" wrote bytes "e9deaa710b" to virtual address "0xB6275F30" ("URLDownloadToFileA@URLMON.DLL") "hh.exe" wrote bytes "ea31c84de7d40000" to virtual address "0xC1CC24D0" (part of module "NTDLL.DLL") "hh.exe" wrote bytes "107ce7befa7f0000e0c3e6befa7f000020e7e4befa7f000060cae4befa7f00003027eabefa7f00007054e7befa7f00008017eabefa7f000040c9e4befa7f000080cfe4befa7f0000004be4befa7f0000008be7befa7f0000" to virtual address "0xC1644338" (part of module "GDI32.DLL") "hh.exe" wrote bytes "f0ef4dbffa7f0000d0c24dbffa7f000030734dbffa7f0000d0e94dbffa7f000020e24dbffa7f0000d0ad4ebffa7f000010074fbffa7f0000d0bf4dbffa7f0000e00653bffa7f000000c04dbffa7f000080cd4dbffa7f000080eb4dbffa7f0000" to virtual address "0xBEB543A8" (part of module "KERNELBASE.DLL") "hh.exe" wrote bytes "c02bb9b4fa7f0000d0b2bbb4fa7f00003010bab4fa7f0000" to virtual address "0xBF6A1048" (part of module "MSCTF.DLL") "hh.exe" wrote bytes "305243c1fa7f0000" to virtual address "0xBCA3F400" (part of module "TWINAPI.APPCORE.DLL") "hh.exe" wrote bytes "00b2e6befa7f0000207ae6befa7f0000b0b0e6befa7f0000" to virtual address "0xC1644000" (part of module "GDI32.DLL")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790799070184,"unified_at":"2026-09-30T20:11:10.184Z","metadata":{"hashes":{"sha256":"e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605","sha1":"c7f303dc0afef28d9d5828eab0aad7ffe04299f9","md5":"320d2e841d145f48f513eba516c1e796","sha512":"72a67dfc88d121a49e41f947fced209d9a6173016af4423ca05694508b52e6b2c7bc1bb4ab63db6ae2a94cd71613d98bf51e3da727e3280bd6795f9bfbca288b","ssdeep":"6144:W6l8MFid+UHNiGDKhM9/v/7YxwNsLi7jmMHEfR2:jl8MF6+MNieKh6rILvMHEQ","ssdeep_chunks":["6144:W6l8MFi","6144:6l8MFid","6144:l8MFid+","6144:8MFid+U","6144:MFid+UH","6144:Fid+UHN","6144:id+UHNi","6144:d+UHNiG","6144:+UHNiGD","6144:UHNiGDK","6144:HNiGDKh","6144:NiGDKhM","6144:iGDKhM9","6144:GDKhM9/","6144:DKhM9/v","6144:KhM9/v/","6144:hM9/v/7","6144:M9/v/7Y","6144:9/v/7Yx","6144:/v/7Yxw","6144:v/7YxwN","6144:/7YxwNs","6144:7YxwNsL","6144:YxwNsLi","6144:xwNsLi7","6144:wNsLi7j","6144:NsLi7jm","6144:sLi7jmM","6144:Li7jmMH","6144:i7jmMHE","6144:7jmMHEf","6144:jmMHEfR","6144:mMHEfR2","12288:W6l8MFi","12288:6l8MFid","12288:l8MFid+","12288:8MFid+U","12288:MFid+UH","12288:Fid+UHN","12288:id+UHNi","12288:d+UHNiG","12288:+UHNiGD","12288:UHNiGDK","12288:HNiGDKh","12288:NiGDKhM","12288:iGDKhM9","12288:GDKhM9/","12288:DKhM9/v","12288:KhM9/v/","12288:hM9/v/7","12288:M9/v/7Y","12288:9/v/7Yx","12288:/v/7Yxw","12288:v/7YxwN","12288:/7YxwNs","12288:7YxwNsL","12288:YxwNsLi","12288:xwNsLi7","12288:wNsLi7j","12288:NsLi7jm","12288:sLi7jmM","12288:Li7jmMH","12288:i7jmMHE","12288:7jmMHEf","12288:jmMHEfR","12288:mMHEfR2","6144:jl8MF6+","6144:l8MF6+M","6144:8MF6+MN","6144:MF6+MNi","6144:F6+MNie","6144:6+MNieK","6144:+MNieKh","6144:MNieKh6","6144:NieKh6r","6144:ieKh6rI","6144:eKh6rIL","6144:Kh6rILv","6144:h6rILvM","6144:6rILvMH","6144:rILvMHE","6144:ILvMHEQ"],"imphash":"Unknown"},"file_info":{"file_name":"1.chm.unknown","file_type":["text","mshelp"],"file_type_id":"chm","file_size":231294,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1674799067000,"last_seen":1676509546000,"last_multi_scan":1676509546000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["targeted","velvetchollima","evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":40,"suspicious_count":2,"malicious_count":2,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/VBS.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericFCA.Agent.69581","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericFCA.Agent.69581 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/Agent.QFY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.AF3F8C28","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.AF3F8C28","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Sets a windows hook"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the Equation Editor Class Identifier (CLSID)"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"suspicious","value":"Queries firmware table information (may be used to fingerprint/evade)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"ScanWithAntiVirus\" (Indicator: \"antivirus\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"hh.exe\" at 00000000-00003036-00000036-670733","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-694951\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-696168\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-1462493\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-1463706\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-3295534\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-3296667\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-4219346\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-4220901\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-13425822\n \"hh.exe\" queried SystemProcessInformation at 00000000-00003036-00000036-13427046","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"hh.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"hh.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"hh.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter _ (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter _ (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)\n \"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"hh.exe\" called \"OpenMutexW\" with parameter \"_!SHMSFTHISTORY!_\" - (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"hh.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeui.ttf\" at 00000000-00003036-00000049-5334498\n \"hh.exe\" queries volume information of \"%WINDIR%\\Fonts\\seguisym.ttf\" at 00000000-00003036-00000049-5592057\n \"hh.exe\" queries volume information of \"%WINDIR%\\Fonts\\seguisym.ttf\" at 00000000-00003036-00000049-5596953\n \"hh.exe\" queries volume information of \"%WINDIR%\\Fonts\\seguisym.ttf\" at 00000000-00003036-00000049-5608491","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\HH.EXE\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\"; Key: \"VERSION\"; Value: \"\")","origin":"Registry Access","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Reads the Equation Editor Class Identifier (CLSID)","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0003000B-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")\n \"hh.exe\" (Path: \"HKCU\\CLSID\\{0003000B-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0002CE02-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")\n \"hh.exe\" (Path: \"HKCU\\CLSID\\{0002CE02-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00021700-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")\n \"hh.exe\" (Path: \"HKCU\\CLSID\\{00021700-0000-0000-C000-000000000046}\\IMPLEMENTED CATEGORIES\\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-65","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3036:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3036:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"\n \"CritOpMutex\"\n \"Local\\SM0:3036:304:WilStaging_02\"\n \"Local\\MSIMGSIZECacheMutex\"\n \"Local\\SM0:3036:120:WilError_01\"\n \"_!SHMSFTHISTORY!_\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\CritOpMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"hh.exe\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"hh.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"hh.exe\" searching for class \"MS_AutodialMonitor\"\n \"hh.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"hh.exe\" sets a windows hook with filter \"WH_MOUSE\" for thread ID 6632\n \"hh.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 6632","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"bullet_1_\" has type \"PNG image data 15 x 15 8-bit colormap non-interlaced\"- [targetUID: 00000000-00003036]\n \"background_gradient_1_\" has type \"JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 1x800 components 3\"- [targetUID: 00000000-00003036]\n \"navcancl_1_\" has type \"HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators\"- [targetUID: 00000000-00003036]\n \"httpErrorPagesScripts_1_\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"- [targetUID: 00000000-00003036]\n \"errorPageStrings_1_\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"- [targetUID: 00000000-00003036]\n \"info_48_1_\" has type \"PNG image data 47 x 48 8-bit/color RGBA non-interlaced\"- [targetUID: 00000000-00003036]\n \"ErrorPageTemplate_1_\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"- [targetUID: 00000000-00003036]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"hh.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"hh.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"hh.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)\n \"hh.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 220852224)\n \"hh.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"hh.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 3697415169)\n \"hh.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.bing.com/search?q=\"\n Pattern match: \"http://www.w3.org/TR/html4/loose.dtd\"\n Pattern match: \"ieframe.dll/ErrorPageTemplate.css\"\n Pattern match: \"ieframe.dll/errorPageStrings.js\"\n Pattern match: \"ieframe.dll/httpErrorPagesScripts.js\"\n Pattern match: \"ieframe.dll/info_48.png\"\n Pattern match: \"ieframe.dll/bullet.png\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"hh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"hh.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"hh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"hh.exe\" opened \"C:\\1.chm.unknown.chm\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"hh.exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"NetWkstaGetInfo@NETAPI32.DLL\" in \"hh.exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \"hh.exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \"hh.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"hh.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"hh.exe\" at 00000000-00003036-00000036-2732014\n \"hh.exe\" at 00000000-00003036-00000036-2732385","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/60 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/60 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["targeted","velvetchollima","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"63d364f2d9493c5f0155eff5","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HTML.Trojan.Agent","submit_name":"1.chm.unknown","analysis_start_time":"2023-01-27T05:45:23+00:00","indicators_count":{"informative":40,"suspicious":2,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}],"processes":[{"pid":3036,"ppid":0,"name":"hh.exe","command_line":"C:\\1.chm.unknown.chm","sha256":"71d890df1b06757543b785459411b430dc672b824f20f726c3ced56de357346e","normalized_path":"%WINDIR%\\hh.exe","uid":"00000000-00003036","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACkUlEQVR42u2XWYviUBBG+4/P0O5bNO5L3Nc/5Mv0Qw++yCgKgqAmRq3Ol3hjjIla9jwNEyhakeacKm/VLd/e/j8ez3A4JMRgMKB+v0+9Xo+63R51ul3qdDrUbrep1WpRs9miRrNJ9UaDlHqdFKVOtZpCTeOzYrFI3xI4Ho83cXDGwR0HOp1ONBqNaDKZmFIvSyBzAHVdpz1iL2JPmgjN+qtqIjRTAgLr9Zo+P39TTVFIfkUCZfcSsOF4fUdgtVrRcrmkXx8fVKnWSJZlngS+cwjs/QQ0K1TNW2CxWNB8PqfpdErj8ZjK5QpPAAfOFvArvwPsFpAk6Sqy+TxPAKfdFNg/UX71IoDXMyPzPzMRM6MaS8rmckwBo9WEgObMXMA9yi8Eds7YqcY5OpCcZQqgz9FqD+Gu7K8FVFsgI2d5AhgyloB+Bb4++dr97A2B7VkgnWF2ASYchos3GO+16/L7ZC8EpEyGJ4DxalbgptedZfeDX7IXAql0mieAMYoK3IDV27J7wUX2toDEFMDFgp62IT4n/hFcCCRTElNAqbsqoF2HJ1y7gVsCOiWSKZ4ArlS7Ai6oJ9gjcxGYpvFkkidQrdUsAfUR+D58u92ZArEEU6BSrZJuCOx8oc/BN2eBaDzBEyhXKg8ELPAjuC0Qi/MESmW3gHqJe2AXXAhEojGmQKlsto+APYSeY+OCC4FwNMoTKJZKpsD2CahX1m6BUIQpUDD2uKcE7oCdAsFwhCeQL9wT2D0FdgoEQmGeQC5fMCeYgHGAngLBEE8AOxz+cfMNsFPgnS1g7HD2RvwX4mcgyBPADoc1CpsMlgnc57hScavhYsFsx3jFhMOQQZ+j1XDaceDwnaPsyBzwH++B13+m/fPPF5bXZc63W0KBAAAAAElFTkSuQmCC"}],"all_imported_dlls":["OpcServices.dll","kernel32.dll","bcryptprimitives.dll","ws2_32.dll","iertutil.dll","netutils.dll","dcomp.dll","urlmon.dll","CoreMessaging.dll","ucrtbase.dll","cfgmgr32.dll","shlwapi.dll","profapi.dll","version.dll","rpcss.dll","cryptbase.dll","ntmarta.dll","gdi32.dll","gdi32full.dll","SHCore.dll","oleaut32.dll","imm32.dll","twinapi.appcore.dll","imagehlp.dll","msIso.dll","ieframe.dll","netapi32.dll","rmclient.dll","aepic.dll","d3d10warp.dll","userenv.dll","xmllite.dll","wdscore.dll","DataExchange.dll","mshtml.dll","secur32.dll","apphelp.dll","profext.dll","bcrypt.dll","EsdSip.dll","user32.dll","win32u.dll","kernel.appcore.dll","ole32.dll","d3d11.dll","WinTypes.dll","winhttp.dll","mswsock.dll","shell32.dll","crypt32.dll","nsi.dll","ResourcePolicyClient.dll","WindowsCodecs.dll","advapi32.dll","jscript9.dll","d2d1.dll","pwrshsip.dll","ShellPreviewHandler3D.dll","combase.dll","msimtf.dll","mlang.dll","msvcrt.dll","msctf.dll","sxs.dll","sspicli.dll","msasn1.dll","msls31.dll","rpcrt4.dll","msvcp_win.dll","comctl32.dll","TextInputFramework.dll","wininet.dll","wldp.dll","IPHLPAPI.DLL","AppxSip.dll","ntdll.dll","powrprof.dll","CoreUIComponents.dll","cldapi.dll","rsaenh.dll","wshext.dll","windows.storage.dll","VxSSL64.dll","uxtheme.dll","cryptsp.dll","propsys.dll","OnDemandConnRouteHelper.dll","msisip.dll","KernelBase.dll","sechost.dll","fltLib.dll","srpapi.dll","wintrust.dll","winshfhc.dll","dwmapi.dll","wkscli.dll","dxgi.dll","winnsi.dll","DWrite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bullet_1_","sha256":"1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"background_gradient_1_","sha256":"1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"navcancl_1_","sha256":"bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"httpErrorPagesScripts_1_","sha256":"65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"errorPageStrings_1_","sha256":"a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"info_48_1_","sha256":"51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"ErrorPageTemplate_1_","sha256":"8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}],"files_written":[{"path":"%TEMP%\\~DF20DF22A9B53DCD88.TMP","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%TEMP%\\~DFA1871547F72E3159.TMP","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\navcancl[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\ErrorPageTemplate[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\errorPageStrings[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\httpErrorPagesScripts[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\info_48[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\bullet[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\background_gradient[1]","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"CritOpMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"Local\\SM0:3036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"Local\\SM0:3036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CritOpMutex","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"63d364f2d9493c5f0155eff5"}]}]}},"report_ids":{"sandbox_job_ids":["63d364f2d9493c5f0155eff5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample e0b131332683… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e0b131332683…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample e0b131332683… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e0b131332683…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e0b131332683a6e8841853c2c898ae0bd8b3015a2e95297727591427ba483605"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample e0b131332683… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e0b131332683…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]