c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8

General

Target

c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe
Size

1.9MB
MD5

840379e60ce24da46d31667a31be0e4d
SHA1

9f14b5557854821d37514143ff89098e3b5fb45e
SHA256

c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8
SHA512

b07605a13810eeb9a8d3f46ba584264e63b1478777e8fba02d817bb3d00b0592d7f3c53ae2096183829dfd8d29ed590aa78104c988b1131235740b68276cd7ff

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

autoplay.exe

pid process

3672 autoplay.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3672	autoplay.exe

Drops file in Program Files directory 3 IoCs

Processes:

c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\Uninstall.exe	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe
File created	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\Uninstall.ini	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

autoplay.exe

pid process

3672 autoplay.exe

pid	process
3672	autoplay.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe

description	pid	process	target process
PID 4800 wrote to memory of 3672	4800	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe	autoplay.exe
PID 4800 wrote to memory of 3672	4800	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe	autoplay.exe
PID 4800 wrote to memory of 3672	4800	c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe	autoplay.exe

C:\Users\Admin\AppData\Local\Temp\c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe
"C:\Users\Admin\AppData\Local\Temp\c07b839b06e6a47b60088316a48acfc38f0a305d2d56377a4dce1d8065c481b8.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4800

C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
"C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
MD5
d4fb9cb4f499568ad1ff3db84d6c852a

SHA1
39a23eb91f5fd356700759b951318a4a9c04b51f

SHA256
9015be133879332704e9ebe3e7af65c8601da25cf412b0a352604e8c8e193fc2

SHA512
091d9fbd7f6c3688ae6387f870c030600ac22dd3133b5ba658b7796df69790453f7e0e73b6474730215ed4b41a558ed12c330b35584bf7a1b339eb00e37b7b49

Download Submit
C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
MD5
d4fb9cb4f499568ad1ff3db84d6c852a

SHA1
39a23eb91f5fd356700759b951318a4a9c04b51f

SHA256
9015be133879332704e9ebe3e7af65c8601da25cf412b0a352604e8c8e193fc2

SHA512
091d9fbd7f6c3688ae6387f870c030600ac22dd3133b5ba658b7796df69790453f7e0e73b6474730215ed4b41a558ed12c330b35584bf7a1b339eb00e37b7b49

Download Submit
memory/3672-0-0x0000000000000000-mapping.dmp

Download
memory/3672-3-0x00000000741B0000-0x0000000074243000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing