dbf3490648efe876bd9a98d53e4d9110bf5e02a3914c0dd4b2a48db4a09799b5

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoHotkey_1.1.37.01_setup.exe
Size 3.2MB
Sample240223-rggrdaah27
SHA256 dbf3490648efe876bd9a98d53e4d9110bf5e02a3914c0dd4b2a48db4a09799b5
MD5 cc2ac8fb9dba7dae570e52f12bf6fbcf
SHA1 34e6cf45bd0f84ccf37092594734a803ec8a837a
SHA512 5fc75ae915ce44a69411c81c9b852475acc6a954fd20d3a2f4850dda7b938e921b8a9ebd79ac3987c2a6c7ec9969b5905c73ecc5341e243ce451d625c9bb2626
SSDEEP 49152:C36KvUPsKJeKbkja1ldZuuHZllQLvdfjab8PkDKwunf0015lxxv+T4:CTvqsKJeKbkj4uQrlQBULKwMp15H1+c
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2136	setup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2136	setup.exe
2136	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2136	696	AutoHotkey_1.1.37.01_setup.exe	87
PID 696 wrote to memory of 2136	696	AutoHotkey_1.1.37.01_setup.exe	87
PID 696 wrote to memory of 2136	696	AutoHotkey_1.1.37.01_setup.exe	87

C:\Users\Admin\AppData\Local\Temp\AutoHotkey_1.1.37.01_setup.exe
"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_1.1.37.01_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\7z730BF2B8\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z730BF2B8\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7z730BF2B8\setup.exe
Size 135KB
SHA256 154d003ebf1db1d330907faf84c3e5543e410d73c93f0b953e7f68823de865a2
MD5 6696d197199daf3bc608176e813489c1
SHA1 7488b6d9952c0e9d4b881160978a019e85f5edd3
SHA512 7bf102c43a0472c4133937a9f34ad07778eb7ebe70b0a9b68f3822bf389de759134f6068d2b80ca9c6edc405a854af3bc0b14190f76c1672af288726ad5805c9
SSDEEP 1536:x1bBeRfYHGPM/5uyckm5H9+73M51qfPqVYlbIstAmSd1GumDYmhywUY5XWqp7Eqg:x98O5zl0s41GumRW2X7Eq2zNCtCFSJ3M
MD5 SHA1 SHA512 SSDEEP

Submit Download