Overview

overview

7

Static

static

3

automatic....nd.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    automatic.mouse.and.keyboard.5.7.3.8-patch-#colorblind.exe

  • Size

    77KB

  • MD5

    7945101171ec44ce32b319e3c90d007a

  • SHA1

    eedc087565e58443963b98a236d39ee5cc42ba2d

  • SHA256

    2be340bc7b649f7f0ce213fb87bf6cb5d0423f5f3cd32f4ba2ef39955872bb45

  • SHA512

    c1bc5c735f69239f8caae8d770474c0e5d59c69236fe0256e0355a62949292d9763f3312704642fd2351149caf9248ac615cfddceed795c09fbf113182996bf0

  • SSDEEP

    1536:fd6NhAc1pG4kHYh+Ll4wJI4QJnwXFs9EdAIXz23QT5wawMaZQQ:oTh+5zJ/QVwX+TIXKo5wbMaZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\automatic.mouse.and.keyboard.5.7.3.8-patch-#colorblind.exe
    "C:\Users\Admin\AppData\Local\Temp\automatic.mouse.and.keyboard.5.7.3.8-patch-#colorblind.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4416
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
      PID:1516
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2548
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4872

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Mozilla Firefox\firefox.exe
          Filesize

          654KB

          MD5

          1fd347ee17287e9c9532c46a49c4abc4

          SHA1

          ad5d9599030bfbcc828c4321fffd7b9066369393

          SHA256

          912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237

          SHA512

          9e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
          Filesize

          56KB

          MD5

          f2b3266b596804b080e9c968169eaed0

          SHA1

          27ed0086f518cd9b65098b72106660a3ffe3453d

          SHA256

          c4de13000f0208808a09ebd3b9b8e86b6d91f4562314c7fa4dc3f48e7fa0bca1

          SHA512

          b153e7051884e48c30bbe402f4c56d339991ea3f9a6bc097d7fc6170a96ab5e90cfddc7517c60095d18d1c45b8b48ee768ddd2a61e5a8afd13a747d76757960c

          Download Submit

        • memory/4416-2-0x00000000756B0000-0x00000000756D6000-memory.dmp

          Filesize

          152KB

          Download

        • memory/4416-7-0x00000000756B0000-0x00000000756D6000-memory.dmp

          Filesize

          152KB

          Download