1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492

General

Target

1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe
Size

1.9MB
MD5

5df8c79d010a75696cd308ee58ceb98b
SHA1

a60fa7200552f46dc19e3f756a1f40b14f3a93be
SHA256

1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492
SHA512

1f0eb9154dc00253b6a5716f513441dfbbdddb5f98ee29198ec61d7086cfdebd58e8b44e57e69d35f83798a995578e1abacd2a85916b2c31f76481a9ea3df10c

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

autoplay.exe

pid process

792 autoplay.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
792	autoplay.exe

Drops file in Program Files directory 3 IoCs

Processes:

1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\Uninstall.exe	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe
File created	C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\Uninstall.ini	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

autoplay.exe

pid process

792 autoplay.exe

pid	process
792	autoplay.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe

description	pid	process	target process
PID 4756 wrote to memory of 792	4756	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe	autoplay.exe
PID 4756 wrote to memory of 792	4756	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe	autoplay.exe
PID 4756 wrote to memory of 792	4756	1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe	autoplay.exe

C:\Users\Admin\AppData\Local\Temp\1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe
"C:\Users\Admin\AppData\Local\Temp\1659e923ca5d1e286f0d6c624abb7e99f75fa2e364d48e797d98051feffa6492.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4756

C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
"C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:792

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
MD5
d4fb9cb4f499568ad1ff3db84d6c852a

SHA1
39a23eb91f5fd356700759b951318a4a9c04b51f

SHA256
9015be133879332704e9ebe3e7af65c8601da25cf412b0a352604e8c8e193fc2

SHA512
091d9fbd7f6c3688ae6387f870c030600ac22dd3133b5ba658b7796df69790453f7e0e73b6474730215ed4b41a558ed12c330b35584bf7a1b339eb00e37b7b49

Download Submit
C:\Program Files (x86)\Adobe Systems Incorporated\Autoplay\autoplay.exe
MD5
d4fb9cb4f499568ad1ff3db84d6c852a

SHA1
39a23eb91f5fd356700759b951318a4a9c04b51f

SHA256
9015be133879332704e9ebe3e7af65c8601da25cf412b0a352604e8c8e193fc2

SHA512
091d9fbd7f6c3688ae6387f870c030600ac22dd3133b5ba658b7796df69790453f7e0e73b6474730215ed4b41a558ed12c330b35584bf7a1b339eb00e37b7b49

Download Submit
memory/792-0-0x0000000000000000-mapping.dmp

Download
memory/792-3-0x0000000073E90000-0x0000000073F23000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing