Analysis
-
max time kernel
22s -
max time network
34s -
platform
windows10-1703_x64 -
resource
win10-20240404-de -
resource tags
arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows -
submitted
08/04/2024, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
AutifityV3.exe
Resource
win10-20240404-de
General
-
Target
AutifityV3.exe
-
Size
29.5MB
-
MD5
a0943523b91013c38f17efab9ef15c78
-
SHA1
c2d1a0a096868389f9f91564925889b7a412f495
-
SHA256
d2b8d7565de0747d49510db130f74f89aa1bb8867bc4f197ab1bdc19a0299f8a
-
SHA512
89be0d29ee370c85d42470b0b5b0925a6308f4b34e43db427db2327aa6d7640fd71589d9d2bd8d038ec83f729df845a856d86975467aa93ae50d1b5e8b82ef12
-
SSDEEP
786432:1ng0nyYuerH5pEmNadaovFLqy3HhxLsIpKyAA84lbz:1ng0yterPbNpoNLlLnpK4z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 96 main.exe -
Loads dropped DLL 42 IoCs
pid Process 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe 96 main.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 96 main.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4628 wrote to memory of 96 4628 AutifityV3.exe 74 PID 4628 wrote to memory of 96 4628 AutifityV3.exe 74 PID 96 wrote to memory of 4124 96 main.exe 75 PID 96 wrote to memory of 4124 96 main.exe 75 PID 96 wrote to memory of 4612 96 main.exe 76 PID 96 wrote to memory of 4612 96 main.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutifityV3.exe"C:\Users\Admin\AppData\Local\Temp\AutifityV3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\onefile_4628_133570684583769120\main.exe"C:\Users\Admin\AppData\Local\Temp\AutifityV3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:96 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Autifity V3 - Loading.3⤵PID:4124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:4612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD520b7c6271603bc7c2087b2e589b51ef3
SHA11d478b8facae3532f3f384fcaf486f9f005873fc
SHA256433310a5fdc3df5f19f905237751156001c69d7805789d6178c6acbb31e90105
SHA512b2d42dc96aa955e92a942f65fc5c2be964bc6d5ea4cf9f1b6c695bde3287a960915f84d3cf8b6ba8c224ba6b268d1f3a0f624e139313925a4644a8911d8d159a
-
Filesize
25KB
MD5ee1df33cce4e8c7d249c4d6cecb6e5f4
SHA14383ae99931aa277a4a257a9bccf3e9ee093625c
SHA256867d830e7c3699df4fa42b0791c0eb6ab7bba0b984549c374851bf5cf4981669
SHA512fccbc4b18bb4bc65135e6a4c73aaabc5093f4b143752a3a03488b06080970ff3531c4c85c6ea9d3922e1aefd852b2b60803f2aa45c84e6620a999500bc4d5099
-
Filesize
81KB
MD5bbe89cf70b64f38c67b7bf23c0ea8a48
SHA144577016e9c7b463a79b966b67c3ecc868957470
SHA256775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
SHA5123ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
-
Filesize
119KB
MD5ca4cef051737b0e4e56b7d597238df94
SHA1583df3f7ecade0252fdff608eb969439956f5c4a
SHA256e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA51217103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
-
Filesize
155KB
MD59ddb64354ef0b91c6999a4b244a0a011
SHA186a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA256e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
SHA5124c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca
-
Filesize
75KB
MD55e9fc79283d08421683cb9e08ae5bf15
SHA1b3021534d2647d90cd6d445772d2e362a04d5ddf
SHA256d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
SHA5129133011ae8eb0110da9f72a18d26bbc57098a74983af8374d1247b9a336ee32db287ed26f4d010d31a7d64eacdc9cf99a75faab194eff25b04299e5761af1a79
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
43.0MB
MD5ae613c178708056aee4eafd475f857a7
SHA1f0840a952f3b62ddb3d47fd64b63b9aa33a8063d
SHA25682b60406c0f8e35c8092e61bc3b96c5758a800dfd4b8f5486587b792890ff58b
SHA512af4fbe00b43f2c0a72b35f86b1608371ed2cd33761a8f11d7b0dc7b03704eed8725b8f9127dab7c8372879400b7e2342f7bb198a880b14c37222eca649da6c20
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
-
Filesize
22KB
MD50d0450292a5cf48171411cc8bfbbf0f7
SHA15de70c8bab7003bbd4fdcadb5c0736b9e6d0014c
SHA256cb3ce4f65c9e18be6cbb504d79b594b51f38916e390dad73de4177fe88ce9c37
SHA512ba6bbcc394e07fe09bb3a25e4aae9c4286516317d0b71d090b91aaec87fc10f61a4701aa45bc74cb216fff1e4ad881f62eb94d4ee2a3a9c8f04a954221b81d3a
-
Filesize
23KB
MD50f4d8993f0d2bd829fea19a1074e9ce7
SHA14dfe8107d09e4d725bb887dc146b612b19818abf
SHA2566ca8711c8095bbc475d84f81fc8dfff7cd722ffe98e0c5430631ae067913a11f
SHA5121e6f4bc9c682654bd18e1fc4bd26b1e3757c9f89dc5d0764b2e6c45db079af184875d7d3039161ea93d375e67f33e4fb48dcb63eae0c4ee3f98f1d2f7002b103
-
Filesize
25KB
MD58f385dbacd6c787926ab370c59d8bba2
SHA1953bad3e9121577fab4187311cb473d237f6cba3
SHA256ddf0b165c1c4eff98c4ac11e08c7beadcdd8cc76f495980a21df85ba4368762a
SHA512973b80559f238f6b0a83cd00a2870e909a0d34b3df1e6bb4d47d09395c4503ea8112fb25115232c7658e5de360b258b6612373a96e6a23cde098b60fe5579c1c
-
Filesize
21KB
MD5ade53f8427f55435a110f3b5379bdde1
SHA190bdafccfab8b47450f8226b675e6a85c5b4fcce
SHA25655cf117455aa2059367d89e508f5e2ad459545f38d01e8e7b7b0484897408980
SHA5122856d4c1bbdd8d37c419c5df917a9cc158c79d7f2ee68782c23fb615d719d8fe61aaa1b5f5207f80c31dc381cd6d8c9dabd450dbc0c774ff8e0a95337fda18bd
-
Filesize
22KB
MD5b894480d74efb92a7820f0ec1fc70557
SHA107eaf9f40f4fce9babe04f537ff9a4287ec69176
SHA256cdff737d7239fe4f39d76683d931c970a8550c27c3f7162574f2573aee755952
SHA512498d31f040599fe3e4cfd9f586fc2fee7a056635e9c8fd995b418d6263d21f1708f891c60be09c08ccf01f7915e276aafb7abb84554280d11b25da4bdf3f3a75
-
Filesize
24KB
MD596789921c688108cac213fadb4ff2930
SHA1d017053a25549ebff35ec548e76fc79f778d0b09
SHA2567e4b78275516aa6bdea350940df89c0c94fd0ee70ab3f6a9bac6550783a96cad
SHA51261a037b5f7787bb2507f1d2d78a31cf26a9472501fb959585608d8652af6f665922b827d45979711861803102a07d4a2148e9be70ab7033ece9e0484fe110fdf
-
Filesize
28KB
MD586e685735fa7cdf6bd65a2f91c984ad6
SHA1f4695a35d506486f17d66b567ad148de8968b0a5
SHA25643d2b19a5bf18232ec7b182dd251c3e0dfda9a8951f849916f9a31143eacad73
SHA51212b8cdf71a3d99fdeea85a6751955505dc962d48e2ec04578a7c8a7de414291dbc3ee72efcc2596a7e0b55d5ffb3bfb13392e25c84a173cfc3e5eaa47a0f7fa7
-
Filesize
32KB
MD5146239634a5fd6c8af1de1e3b0e063bd
SHA1b61d62d9e751f08094b9fdf4354db0be17828a08
SHA256447e3da0363159eb7d6b309a780dd5af66c3ee274f4b24feccda14e65c397a09
SHA512f49b10d68811ad728b68c1a5c09b43fb5c4b90f07cac537c4fb2dd78cd07c5843589ba0e2ec3e11a927c47134f46c267827e5b1f61d00885e007e4b410efc08b
-
Filesize
21KB
MD58070eb2be9841525034a508cf16a6fd6
SHA184df6bceba52751f22841b1169d7cd090a4bb0c6
SHA256ee59933eba41bca29b66af9421ba53ffc90223ac88ccd35056503af52a2813fe
SHA51233c5f4623a2e5afe404056b92556fdbaf2419d7b7728416d3368d760ddfde44a2739f551de26fa443d59294b8726a05a77733fee66abc3547073d85f2d4ebeee
-
Filesize
861KB
MD56d44fd95c62c6415999ebc01af40574b
SHA1a5aee5e107d883d1490257c9702913c12b49b22a
SHA25658bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
SHA51259b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3
-
Filesize
177KB
MD56f1b90884343f717c5dc14f94ef5acea
SHA1cca1a4dcf7a32bf698e75d58c5f130fb3572e423
SHA2562093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1
SHA512e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73
-
Filesize
60KB
MD5d856a545a960bf2dca1e2d9be32e5369
SHA167a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA256cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
SHA51234a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
-
Filesize
153KB
MD50a94c9f3d7728cf96326db3ab3646d40
SHA18081df1dca4a8520604e134672c4be79eb202d14
SHA2560a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
SHA5126f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
-
Filesize
29KB
MD552d0a6009d3de40f4fa6ec61db98c45c
SHA15083a2aff5bcce07c80409646347c63d2a87bd25
SHA256007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
SHA512cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824
-
Filesize
75KB
MD50f5e64e33f4d328ef11357635707d154
SHA18b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA2568af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA5124be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
576KB
MD501b946a2edc5cc166de018dbb754b69c
SHA1dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA25688f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
SHA51265dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
-
Filesize
28KB
MD5c119811a40667dca93dfe6faa418f47a
SHA1113e792b7dcec4366fc273e80b1fc404c309074c
SHA2568f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
-
Filesize
1.1MB
MD54c8af8a30813e9380f5f54309325d6b8
SHA1169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA2564b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
SHA512ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7