Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
04-11-2023 03:37
Static task
static1
Behavioral task
behavioral1
Sample
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
Resource
win10v2004-20231020-en
General
-
Target
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
-
Size
4.5MB
-
MD5
5b9199d8d78e1f243dd06650ea280d2b
-
SHA1
c9ea60db6995c7601831eb53392f35ddeeeec019
-
SHA256
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a
-
SHA512
1a3340e7b9cf03ab73fc04eee7b6a5cd6883027b19ec9373fa15f74b2d75065ed71972be4572c2cda61f05174f3d4f121676fdae05ebaf6e2144904c1efa9813
-
SSDEEP
98304:WHBlU61iNt6x9G7phImiaE9YwciOWdQ/kJFpMExVMU:WHTU6QW9yImi2rWOk3xy
Malware Config
Signatures
-
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1764-23-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral1/memory/1764-183-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral1/memory/1764-199-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral1/memory/1764-200-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral1/memory/1764-201-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral1/memory/1764-202-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1764 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 1764 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: SeRestorePrivilege 1764 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: 33 1764 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: SeIncBasePriorityPrivilege 1764 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe"C:\Users\Admin\AppData\Local\Temp\5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1764