329db242a00f0dcf4e2f6390b06c837fd992cabb2cc4d0eda8278a8c57d4b044

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2024, 03:14

Target
2023-10-12-AutoIt-script-file-for-DarkGate-example-1-of-3.au3
Size 12KB
Sample240207-drfp6scbb6
SHA256 c01d186f412fac04b0b80c6242c378ee00d1c63affb83d44ee75f65a08f4e966
MD5 1d9e64a4fb4eddc87df990d8e9be6cae
SHA1 1b6bbc58d0153247e418bd2cb6665057601ff075
SHA512 16cb48892e0effafe0f643f7736fa44aeed8f653dc2558ceab3c4eb95132b5e67c3eebc47af9dcddc2cfd4a2e04278fc5c651590f2bb3fe5baacc3a85bdfca64
SSDEEP 96:LAQ3RilxfVyAEHp2VJpqL6zZmq2Cws+2J6uXA+srR/6kdUWot1KTDi8xxLtc7IS2:c12LJ56MHLunqVLtynAU2n4VY7E3wJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2332	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2023-10-12-AutoIt-script-file-for-DarkGate-example-1-of-3.au3
1⤵
- Modifies registry class
PID:1440

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact