c1b9767756e0c85dd2a04013e53cb97817a055135fde76046871279297addcfd

General

Target

AutoWizard.exe
Size

38.3MB
MD5

8ef2804f01784e97957a16ca44dc41bf
SHA1

6438f214cb5c1e09d136b94f0b4717db063d0993
SHA256

c1b9767756e0c85dd2a04013e53cb97817a055135fde76046871279297addcfd
SHA512

a2db781b83e978e8fe1328a0806b4728015de93b433b0ee7b527299f57db29a19fbe8d262011c2c6d68df4b3cac270ed06d0e1d7f5e97392e27ee4e72c6659ef
SSDEEP

786432:nLlhB4VtKoI5m4F21NglZqYljcTCgoMJ5Ux3KKCYe7+mYsv9S5X3NB:L0tKoq21Qt4CJvAKCYe7+Go5n

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2244	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2780	Autoclickersetup.exe
2164	Stub.exe

Loads dropped DLL 3 IoCs

pid	Process
1872	AutoWizard.exe
2780	Autoclickersetup.exe
2164	Stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2728	timeout.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1344	AcroRd32.exe
1344	AcroRd32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2780	1872	AutoWizard.exe	30
PID 1872 wrote to memory of 2780	1872	AutoWizard.exe	30
PID 1872 wrote to memory of 2780	1872	AutoWizard.exe	30
PID 1872 wrote to memory of 2932	1872	AutoWizard.exe	31
PID 1872 wrote to memory of 2932	1872	AutoWizard.exe	31
PID 1872 wrote to memory of 2932	1872	AutoWizard.exe	31
PID 1872 wrote to memory of 2968	1872	AutoWizard.exe	32
PID 1872 wrote to memory of 2968	1872	AutoWizard.exe	32
PID 1872 wrote to memory of 2968	1872	AutoWizard.exe	32
PID 1872 wrote to memory of 2244	1872	AutoWizard.exe	33
PID 1872 wrote to memory of 2244	1872	AutoWizard.exe	33
PID 1872 wrote to memory of 2244	1872	AutoWizard.exe	33
PID 2244 wrote to memory of 2728	2244	cmd.exe	35
PID 2244 wrote to memory of 2728	2244	cmd.exe	35
PID 2244 wrote to memory of 2728	2244	cmd.exe	35
PID 2968 wrote to memory of 1344	2968	rundll32.exe	36
PID 2968 wrote to memory of 1344	2968	rundll32.exe	36
PID 2968 wrote to memory of 1344	2968	rundll32.exe	36
PID 2968 wrote to memory of 1344	2968	rundll32.exe	36
PID 2780 wrote to memory of 2164	2780	Autoclickersetup.exe	38
PID 2780 wrote to memory of 2164	2780	Autoclickersetup.exe	38
PID 2780 wrote to memory of 2164	2780	Autoclickersetup.exe	38
PID 2932 wrote to memory of 2132	2932	rundll32.exe	39
PID 2932 wrote to memory of 2132	2932	rundll32.exe	39
PID 2932 wrote to memory of 2132	2932	rundll32.exe	39
PID 2932 wrote to memory of 2132	2932	rundll32.exe	39

C:\Users\Admin\AppData\Local\Temp\AutoWizard.exe
"C:\Users\Admin\AppData\Local\Temp\AutoWizard.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\Autoclickersetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Autoclickersetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\onefile_2780_133712470948532000\Stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Autoclickersetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2164
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\toggle.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\toggle.py"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\autowizardmacro.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\autowizardmacro.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1344
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF364.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autowizardmacro.py

Filesize
1022B

MD5
57548ef8569dba8cbfbcd0dafbe242b6

SHA1
09bcbe02692df3b347bcd8b4b7bf7a9bd2af5820

SHA256
92a177095ca989cd0e07f3bf36bc2d8f3ecc33105ccbc1d1d906a3b9eab69535

SHA512
19dcedacedfb6a3d176c7492170f374b9e3c93ae8c75f065715c1d8c3077869fc06cf6df230360acb93038ae5d3d67c16b1e7264589c8125b49eb3e6003151f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2780_133712470948532000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF364.tmp.bat

Filesize
162B

MD5
c97f05b5e8974be8130278f967f5a98b

SHA1
2903157a86f700f057f7b3457b97f03bd04acb6d

SHA256
e65e7856a4626015caa90350aa95482aee218ca662bfc5d5b1737c1431375bbf

SHA512
9be6b002bae7a1d069656cfd8d5d46b5ea10485113098159a00cfeac2b957a883b13c3217c74145c821d33247c2f6b294e73a102c7d17de3de6b41935d7809a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\toggle.py

Filesize
993B

MD5
e8b5ad66c14f55adac0d510fc79cab44

SHA1
2c789463a88d30bbde34f3e2c3585166bb9ba395

SHA256
63ef691c1d3ee45909bf403517951cbadc7c88a13cf9d5b4f3c7bed1c67483e4

SHA512
a11cf3de54031ae7f7fb23acf286a44b8a4bf98a64a432e4bcf543f231f8bb998ae2bdda98f3cc34f1829c9654910f15a7be6e013b53b17048856aadbed064c9

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00dfe47d8f0fe285c5eb7eac6db549b7

SHA1
31a019b6687d4e6da2a3da4ed8e6e2cb243db737

SHA256
203641d242cc648e0c3a8682f716920e9dd6ea7d0d6b692bd89d516ad4fe5d99

SHA512
242df59031f39e602cf5da8201cca797a4ffc9136c66ab4e9e728a4d062881a29a359fbe73fb47cbe7f1c085d02cfce96ab9a769de375c02d64fe342ada0763f

Download Submit
\Users\Admin\AppData\Local\Temp\Autoclickersetup.exe

Filesize
38.4MB

MD5
5c86af29498bed9af530e273d2935989

SHA1
d7fe55bae0668a5b6972985ec8de622940492104

SHA256
e8d07f42903f50cb8ac1842acbd1890f00693df8a86fd1d8c4c3c52efdb23c59

SHA512
a9ceb58d7428c033b6458845209666b90115325148c2cd773297ebff702950b285c054d34e7ef0a22bc592c7576a1da80fcbfda21563d81ffb7985b2dabd656c

Download Submit
memory/1872-0-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/1872-1-0x00000000003E0000-0x0000000002A36000-memory.dmp

Filesize
38.3MB

Download
memory/1872-2-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/1872-36-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing