Analysis
-
max time kernel
83s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
01/04/2023, 00:29
General
-
Target
AutoHotkey_1.1.36.02_setup.exe
-
Size
3.2MB
-
MD5
a8bb29edad96ff3dd023492a569581a8
-
SHA1
01e344345aa2b036550f657b5bc4a6d91b3ac831
-
SHA256
af7b8e60b4b54f5f85e6b207ac51926cb076aa4319b8e4c72e59b98c85818cae
-
SHA512
61583cd38144971bd76b7742670b2e8f78713a2c66bcd8049c99a90191ed9022f9123b4fba6f891f9e6b20a58d7b2444df85421e053235a8e6d08d32b283d06d
-
SSDEEP
98304:C9h0bMA834/tGqFK0eIYPCwXJWxZYb2z/1o6TqN6Vu:C9h0IA834/tGqiIsxwzNo6TqNsu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_1.1.36.02_setup.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_1.1.36.02_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7z65628E8C\setup.exeC:\Users\Admin\AppData\Local\Temp\7z65628E8C\setup.exe2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PopUninstall.mpv2"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
870KB
MD5590618fcaa5e7577ae989ab094917e8b
SHA19a62241af75b93fa6d77d97464e2f0a592fa940c
SHA256aa86096bfd7efbe4bcd9a17d2a8378cb8125826863508449720628e2a19f6175
SHA5129c99d79f0817ff23f70ca8f226ccabd5ca9f225b9a32f96e13539c725c97ef937e85eaf3d3fda739b5b27242b435a820f611aee4afc4dec84286e98baf31ab0a
-
Filesize
870KB
MD5590618fcaa5e7577ae989ab094917e8b
SHA19a62241af75b93fa6d77d97464e2f0a592fa940c
SHA256aa86096bfd7efbe4bcd9a17d2a8378cb8125826863508449720628e2a19f6175
SHA5129c99d79f0817ff23f70ca8f226ccabd5ca9f225b9a32f96e13539c725c97ef937e85eaf3d3fda739b5b27242b435a820f611aee4afc4dec84286e98baf31ab0a
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
16.7MB
-
Filesize
252KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
412KB
-
Filesize
444KB
-
Filesize
344KB
-
Filesize
160KB
-
Filesize
144KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
140KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
72KB
-
Filesize
132KB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
68KB
-
Filesize
604KB
-
Filesize
72KB
-
Filesize
2.2MB
-
Filesize
1.1MB
-
Filesize
212KB
-
Filesize
148KB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
68KB
-
Filesize
76KB
-
Filesize
72KB
-
Filesize
636KB
-
Filesize
68KB
-
Filesize
1.0MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
164KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
68KB