Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 18:55
Static task
static1
Behavioral task
behavioral1
Sample
ZyuL.io AHK.ahk
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZyuL.io AHK.ahk
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ZyuL.io AHK.ahk
-
Size
2KB
-
MD5
37ea91ac7fdfa0541733fd16a54c421e
-
SHA1
6fa7a6670222574d4b78e448e993f5c4b81f612b
-
SHA256
c55cfb43fc59421ef33f07d3d40e7446ed25bd10929949c49c9427d31238fe13
-
SHA512
86c923d29096d4d65d9f706d79ada1fcd12deb18bfb016b680f55f65682e66b66b6dfdb933e021cabbc7b9d7d1ef438f5f3bd8af3b80e6417af7e88efc61f349
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2696 taskmgr.exe Token: SeSystemProfilePrivilege 2696 taskmgr.exe Token: SeCreateGlobalPrivilege 2696 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1548 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ZyuL.io AHK.ahk"1⤵
- Modifies registry class
PID:4072
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1548
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696