Overview

overview

5

Static

static

5

AutoIt3.exe

windows7-x64

3

AutoIt3.exe

windows10-2004-x64

1

script.exe...pt.ps1

windows7-x64

1

script.exe...pt.ps1

windows10-2004-x64

1

script.exe...AL.ps1

windows7-x64

1

script.exe...AL.ps1

windows10-2004-x64

1

script.exe.a32.exe

windows7-x64

3

script.exe.a32.exe

windows10-2004-x64

3

Resubmissions

20-03-2024 17:17

240320-vtqftsef8z 5

20-03-2024 14:47

240320-r5yd2aba29 5

Analysis

  • max time kernel
    314s
  • max time network
    320s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-03-2024 14:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AutoIt3.exe

  • Size

    872KB

  • MD5

    c56b5f0201a3b3de53e561fe76912bfd

  • SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

  • SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

  • SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • SSDEEP

    12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe AutoIt3.exe script.exe.a32-ExtractedScript.au3
    1⤵
      PID:2872
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
        AutoIt3.exe
        2⤵
        • Modifies registry class
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2060
      • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
        AutoIt3.exe
        2⤵
        • Modifies registry class
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2060-0-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-1-0x00000000042D0000-0x00000000042D2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2944-2-0x00000000043E0000-0x00000000043E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2944-3-0x00000000048D0000-0x00000000048D2000-memory.dmp

      Filesize

      8KB

      Download