Analysis
-
max time kernel
596s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
08/01/2024, 09:52
General
-
Target
AutoIT.7z
-
Size
493KB
-
MD5
665f47f18a4a3b774d7b020a76dc336e
-
SHA1
316b3c7381f69f60b15c18cda7a6302388a2c8e2
-
SHA256
6d76da6f6a880be58e575fa9c16fc162dec02a031e914bed7a0c8d9b25095939
-
SHA512
9ea0c2b24089beaa9b3ffe4d05d2d4eea5d6e30458a9854f43dce1528c78b98d87c768cc19de19d9210a66661d17e318bb1f82e4f447d21d66e55e2f85962f9b
-
SSDEEP
6144:VXz/3MI8BDkwBfnzvcKbU5bRy2HnN9ShzRPR8Pb1iF0YgeANJTR2HoHGc7NQtz8R:5TKBD9ft+bRPNMXRlkXkIm0NQ9Dq
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AutoIT.7z1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AutoIT.7z"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB