Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/09/2024, 22:58
240928-2xs5fssgje 7Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 22:58
Behavioral task
behavioral1
Sample
AutoHotkey_2.0.18_setup.exe
Resource
win7-20240903-en
Errors
General
-
Target
AutoHotkey_2.0.18_setup.exe
-
Size
2.9MB
-
MD5
71e486a03ab282b75886e3712ebb1efa
-
SHA1
33501837a85ea22f98723746aecf5199865353f9
-
SHA256
a30af310f45d4076cf1580bb08015db9a1337ddc1a99cf61829e645b196e8b2e
-
SHA512
855e76b756a5b3d2a465a900fe146eaa7113fe45a7b8c88e057b8d4f975b2b08b8b6b11ea1a697fc7df2fea3f6f0772e6c356e109240bb4e655efae7dc407f55
-
SSDEEP
49152:7rPT2Gn+45fu74LQ7A8Y+kKuxIhMF2dRvwKfrPwzuedUzxS3:/PT2a+45fjLQ9YhKuxI+kdGKTPY7dR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2516 AutoHotkeyUX.exe 2532 AutoHotkeyUX.exe 2980 AutoHotkeyUX.exe -
Loads dropped DLL 14 IoCs
pid Process 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 2368 AutoHotkey_2.0.18_setup.exe 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 2532 AutoHotkeyUX.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/828-0-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/828-1-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/828-2-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/2368-3-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/828-5-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/2368-166-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/2368-165-0x0000000000400000-0x000000000094C000-memory.dmp upx behavioral1/memory/2368-358-0x0000000000400000-0x000000000094C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\AutoHotkey\v2\RCXFF26.tmp AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-editor.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-setup.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\ui-setup.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\ui-base.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\license.txt AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\Install.cmd AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\WindowSpy.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\reset-assoc.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\common.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\reset-assoc.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\ShellRun.ahk AutoHotkey_2.0.18_setup.exe File opened for modification C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\launcher.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\ShellRun.ahk AutoHotkey_2.0.18_setup.exe File opened for modification C:\Program Files\AutoHotkey\v2\RCX2696.tmp AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\WindowSpy.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\reload-v1.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\config.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-uninstall.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\identify.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\installed-files.csv AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\AutoHotkey32.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\AutoHotkey64.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-dash.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\EnableUIAccess.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\identify.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\v2\AutoHotkey.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\launcher.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-newscript.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\bounce-v1.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\ui-base.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\Templates\Minimal for v2.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\v2\AutoHotkey.chm AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\AutoHotkey.chm AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\ui-launcherconfig.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\reload-v1.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\identify_regex.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\install-ahk2exe.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\install-version.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\ui-dash.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\WindowSpy.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\config.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\launcher-common.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\README.txt AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\Templates\Minimal for v2.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\v2\AutoHotkey32_UIA.exe AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\install.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\CommandLineToArgs.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\spy.ico AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\ui-launcherconfig.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\CommandLineToArgs.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\EnableUIAccess.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\spy.ico AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\UX\inc\HashFile.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\common.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\CreateAppShortcut.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\GetGitHubReleaseAssetURL.ahk AutoHotkey_2.0.18_setup.exe File created C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.18_setup.exe\UX\inc\identify_regex.ahk AutoHotkey_2.0.18_setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoHotkey_2.0.18_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoHotkey_2.0.18_setup.exe -
Modifies registry class 50 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\DefaultIcon\ = "C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe,1" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs\AppUserModelID = "AutoHotkey.AutoHotkey" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\UIAccess AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Edit\Command AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\ = "AutoHotkey Script" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ShellNew\Command = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\ui-newscript.ahk\" \"%1\"" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Launch AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.ahk\ShellNew AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Open AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" \"%1\" %*" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\Command AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\Command AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\AppUserModelID = "AutoHotkey.AutoHotkey" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\ = "Open runas UIAccess Edit" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\DefaultIcon AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\ = "Launch" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\ = "AutoHotkeyScript" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" \"%1\" %*" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\AppUserModelID = "AutoHotkey.AutoHotkey" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\AppUserModelID = "AutoHotkey.AutoHotkey" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Launch\Command AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" /Launch \"%1\" %*" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\ui-editor.ahk\" \"%1\"" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.ahk\PersistentHandler AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\RunAs AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\ProgrammaticAccessOnly AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings AutoHotkeyUX.exe Key created \REGISTRY\MACHINE\Software\Classes\.ahk AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\FriendlyAppName = "AutoHotkey Launcher" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Open\Command AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\ = "Run script" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs\Command AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs\HasLUAShield AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\Command\ = "\"C:\\Program Files\\AutoHotkey\\UX\\AutoHotkeyUX.exe\" \"C:\\Program Files\\AutoHotkey\\UX\\launcher.ahk\" /runwith UIA \"%1\" %*" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\ = "Run with UI access" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\AppUserModelID = "AutoHotkey.AutoHotkey" AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\RunAs\Command AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\UIAccess\Command AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\Command AutoHotkey_2.0.18_setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AutoHotkeyScript\Shell\Edit AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\ = "Edit script" AutoHotkey_2.0.18_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ahk\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}" AutoHotkey_2.0.18_setup.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\17F9F545F2C0584665A7221CFFD29526FF4C9BD7 AutoHotkey_2.0.18_setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\17F9F545F2C0584665A7221CFFD29526FF4C9BD7\Blob = 03000000010000001400000017f9f545f2c0584665a7221cffd29526ff4c9bd70200000001000000840000001c0000003400000001000000000000000000000000000000020000004100750074006f0048006f0074006b0065007900000000004d006900630072006f0073006f006600740020005300740072006f006e0067002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000002000000001000000e1010000308201dd30820146a00302010202104e2c43300dbf43ad41006281858f5fda300d06092a864886f70d01010505003015311330110603550403130a4175746f486f746b65793020170d3234303932383232353832355a180f39393939303130313132303030305a3015311330110603550403130a4175746f486f746b657930819f300d06092a864886f70d010101050003818d00308189028181009785176f4196dbdaac6b516b1f0f5bd555a6f06b5bfa44e61a165cbc50e9665a9e2d840044408e364f8f00b21b2984583c40a43d01061af9af12798eb712185718c1f1fd71c8733a2401a92386f11a0e7454150865ec11919973002faebc5bbba78e838d670c9ae7e8733eaae13567456480f94ccdbd6e6b980744578195496f0203010001a32c302a30100603551d040101ff040630040302049030160603551d250101ff040c300a06082b06010505070303300d06092a864886f70d0101050500038181006cf6a551d2df376d72ef10be74ba915f10058ecddbd41d1604413d8d954141c652898e063138f96564730088919d6492835a990d3128cdd70287b6bac6e660364f6956e8382fce5a6d8fb53a33b04af89eb06421d0b3a8476e564b36d3d553c55be25c9cd20e3b04ce099a002021633181dd386e1af2f8ef16d5ae2c8a579c8d AutoHotkey_2.0.18_setup.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 828 AutoHotkey_2.0.18_setup.exe 2532 AutoHotkeyUX.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2368 AutoHotkey_2.0.18_setup.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2516 AutoHotkeyUX.exe 2516 AutoHotkeyUX.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2516 AutoHotkeyUX.exe 2516 AutoHotkeyUX.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 828 wrote to memory of 2368 828 AutoHotkey_2.0.18_setup.exe 31 PID 2368 wrote to memory of 2516 2368 AutoHotkey_2.0.18_setup.exe 32 PID 2368 wrote to memory of 2516 2368 AutoHotkey_2.0.18_setup.exe 32 PID 2368 wrote to memory of 2516 2368 AutoHotkey_2.0.18_setup.exe 32 PID 2368 wrote to memory of 2516 2368 AutoHotkey_2.0.18_setup.exe 32 PID 2532 wrote to memory of 2980 2532 AutoHotkeyUX.exe 35 PID 2532 wrote to memory of 2980 2532 AutoHotkeyUX.exe 35 PID 2532 wrote to memory of 2980 2532 AutoHotkeyUX.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe" /to "C:\Program Files\AutoHotkey"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2516
-
-
-
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-editor.ahk" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"2⤵
- Executes dropped EXE
- Modifies registry class
PID:2980
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2872
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d0cc6a21113957474e095fca77d75abd
SHA1ea84155577bc74bf65d902425c15543509c80f4b
SHA25670031669fef8c365a243322c52df9c3f854271489e67c5a9fc3139f56bc357e9
SHA5122ad8fdbbf79934560b42ac6064d86276a7e24f6d8610d163b4d551e736b72b8dd6070e0e0b21599f781ef638be9c3d6aff8e8e3e9b7a2c00be948477b6558934
-
Filesize
93B
MD5cdc8756680c459bd511d2bd2895fe2b2
SHA1a7ea57fd628cfe2f664f2647510c6a412c520dfb
SHA2567f618d3ca343a0739a52a4a3c4f5b963ed98dc077b60c65fdc77d70fb0ec12d3
SHA512101722eb5bba352d557e7d70704e24a54a129276857e8cc13f40da26dfa9267a67de79e52a0f552ff676d1825d0fb2eb467837b397d2e6905fa90d6891bccd45
-
Filesize
7KB
MD5e2067d978526b83a1da967f16a69c125
SHA108000fb66e6f1b1fcd450f32e1757a39b3a7ba16
SHA256040404a4def02f17cdafda938f5b63fc2181940ba1290da5742db0862c07166e
SHA512a453669b15c18f24a989a57441f961861578c09c145a4364c982410e5e05ab09b05ad4a77929ccf4ab9e00e5e3d73029a13660156bf4eef9011accfd59800ea0
-
Filesize
352B
MD5e8d9a7e78d6a2a40bfb532b4812bde59
SHA15674b63092a69c419a42bab9e7462bde3bdb3cad
SHA256a6c51e2188e31e3510577263d7b96db147b0df3dfa24c96df8fdd9d73da859ee
SHA512dd7d78c7724dca4684c732b0f3f8e73af67610de8945255b48b9301672ac0b4f405c802a8cd4c343d53266f492d2d0dcd2727b5ebdb9e90cfc9173876b9ab905
-
Filesize
1KB
MD52ffbde65b63790c5aa12996e9ef9068c
SHA1a793986e4e72d5b5a866e927855eacc3a0399a7a
SHA25640a6f0cda5fd1dff324cab288bb453aa60b41b09dacbfbc64f2d871423f33935
SHA512315b2803c8e803b238e87de63a5737350e41d248f67c54662341ca889c3bd5fc6fc2f516ca20f1ff4d74fca4af247b64ec7795d4c4e8990fffce49bbf037a906
-
Filesize
10KB
MD565d05ec61cca0547e218655e65e5ea7c
SHA11cf93558bb9f1ae5a055b3f9085bf4166b7f43dd
SHA256a9a824a763195e5810bf904854af7ed41c025527b2b8faa7532c6f24189d69b9
SHA51265172fa0f9148106e44fde99e0bcad173c4eef405a19b1f54961f2a248f6e6b0a05568d728e83d6582113d0d12a5e87ce763c53271c4d52b9362b19e22ea7d23
-
Filesize
844B
MD51a8ab9bb38fd0da51d03dc48e3a0b2ea
SHA15c74ddd45c91a39b921139881c76c48c97e35825
SHA25648a3f822a720b8e9b41165a1d19d56411d1f58036338ebd07ab40f2a14cf0f1b
SHA5121b88603fb9eb28e717cb77623ff0159f5f45e677c34316dc0c5d5c2ed46c59f10d3afb532b1f99920f91b8098e544873f944b1e0e575efd694dd24bdca22c14e
-
Filesize
2KB
MD5727ae6f2ec77a5b56774df9da14636d2
SHA18216a2122c825127ca59b05b0bae0d57e92f1110
SHA25684032ecac8ed334cf8788a81bea721b0af5cd7ca7dca57b60cdec3556ae33914
SHA512f1058216b5d1b8d590eb4cafd5139f71f8df5f96a3fcc314a7635cb1b99de8623d87c57c567868ebdafb09925b8d13fdadcee49fa89f1a239725a92b948272cc
-
Filesize
182B
MD54b095aae00456aa248024a184671e4d5
SHA184ae516fbc62ce0aa10ffeacd7ba865a35a0a375
SHA256d65c6e73417e6bba7a619f2e68933b74e6ae6141277b65542aed9b6acdfc83ff
SHA51277aabe92719d8fc7a28c76f3b76fa2e42a188db14f004262d8e913620aa990cde29119b82d919511fc0d828ca0a108ea79858ba158b6a8ed6a260b72b4ee229d
-
Filesize
420B
MD59e53fca8c7f6a9ee179f0fc0a7890ea3
SHA1dc2a1bf437eea36b3f5ba9318f3b391b405d5cb2
SHA256ea67340c555fdc1abf8e324ac550ac37d2ba5f96a8edef120e72fb340f8f95c0
SHA512cad5c07f952fb93413b4a3990c522ba4b446ae41f11c8dd323bdcde1b30fbfd76515606d5dc4bcb8768bd382cdb82553801539a192b002696d253341f3c0dbc5
-
Filesize
142B
MD5165b8fc572f943e3665994f87f1772b7
SHA1265ca3d2a66a7e1807962eb7e8a444cefb61bc0c
SHA2569b75c7f804d1d55807459e6f06db2bee8e1fb60ce9c9340d44a7b491ce53b982
SHA512e675453eef9a10560cb9ea95e993d8068c8dfca3664a140b6ba33361d0736632b8ce3a37770411583f558476173294bcc12b83bf33190d89eb009bfb9bb5f0af
-
Filesize
688B
MD5dac79ad5a978f0497de70a005b6a6084
SHA1db100ce15998772fe322679468f46b0f25239eb4
SHA256dbc1420c9368e954176cd1bc38c0bf5498d721cb7dee50b5abef51611a33c658
SHA5129f2a2c0e01724ef82860cfb97fbe6196d29b3b41080f04b3f51653f2f535849428b0a245bc954aa57569aa660d5a5a20d2d1e0dbb9081d718bf2deddb051f47c
-
Filesize
429B
MD5248b58535f55eb55d9baec04a384b5e6
SHA176d067318b67da9a3da71a232a887c8935c7068f
SHA2564d1f241a0c973e30f1bf19e71cadb386b872a14bf0c29d32d4781a56cafd998a
SHA5120186eb49da706c6cc6f48ecd94a4996c258ecea10bed26b9c79bddf0f7eca32df1449166309237859ca2508427bf79d447a2202eaeba211228da9822646cf23a
-
Filesize
1KB
MD53e5c97e6c3a76686329c81fba864b26b
SHA1ec111d01a5299de2ca93c5441e92bb49d9d5e710
SHA256f5b97911887c303b6859de44eff73780309e31e931dcba86a66aaafbe932af72
SHA512c70ba459abb2c35edfd62dfbe6efb9c54d5341802a72ac7d6b3b63877f28a97a974b96b6de747e29909550d6ba2c5d14da40bef6d91841c5c8c5a903697307c7
-
Filesize
3KB
MD5f27f09d324016bd49d2da38901e79a61
SHA1f2af4ea1ca36dc4ed53ba3a5817b83d457c9029c
SHA256c2563ab626df892398083404acecc5229300ba7dc6077b120844c65facfad854
SHA5121dd5a6ddf87a3026f5b2d468197173af0c4e6c2eeab64113bcd2bbd56be46089e546f694fea2416aadc9c2669070b29ef26ec689dfbe73def8af6fd0de310d04
-
Filesize
2KB
MD565029d2c4fd46ea517b13d615a0584f5
SHA1fb924c85e3e032b997aa86f85964516849baeb27
SHA256220629b006d13b24afb3367abeea424c5b4103ac0c5a137fdc9d98047cdd908f
SHA512c1346142f1b6dd5bd9a0d8cc9aac843e117f646f09a7ac40488ab513781d0162504249d7305e63080363bd273ffbb9d5f29c6dd860b9a80928aba944cfd51a0c
-
Filesize
4KB
MD5eeecd8af162d3f318496e0e60d6d8c57
SHA131a99c80e4f1033914ce9344e95b84571f76ad2d
SHA256968473df8eac7264d9e84e6ae91a4d706cda9f89f345d182617b161ef4fe1a7b
SHA5126f55968adf7f2f02e128945016ed0c4d003c9640e4cbfc7b22b82374647e6ebdb07c02e99240da369789f4107d2c130e54d4acb1324455fd26668c4d1d009884
-
Filesize
4KB
MD5f4251e653dbbbdd8cf4640bd9855c207
SHA1d08b6e5796150aa1436fd3da39bfc5fdbaaee297
SHA256deffd87d99ff125eccac2331a8ba4e3a0044e150e80316e9469dd57f322beda1
SHA51286896ccb0acbd27eeefe6e02747958cafcca31541638435dfe9f08d89b763144f6b5fb521df11dce4c3f46b186de4905f56ebcc7c57d4c29ef2a0731a6492698
-
Filesize
1KB
MD5c90bed0679b789b74e4865ae6f2709a3
SHA1b0dbee6a237ba93daec76a0553cd3254821d60a1
SHA256c242ebb51241acab13152d95cdb05be5382ffb97f3dca2da3a4e5a084c2e3ff4
SHA512f8dfe5c558b427e05905b2a3d8a09632347edf945d47ed4fc82ec38a9045f5837a798ef669f0fdae6504d9eee6762c49c8e6c32adac0f6a3e6c2eed6d48e64b2
-
Filesize
4KB
MD530b87fbfadc592c38be9d82edf597fa3
SHA11ff5d720858a38bdd2e21a5a492938c07b2811a5
SHA2561e59921bcddb3c41651eb01605cdefcdee3c6adec5db6b7cafb7ab801ead5e1e
SHA51279a407cad251f45d13c0505cdf7e27a281455e3eefe1f7fc5aedd658297351ac7dbbce21065a29ed9d86c6b908a175cd83201e0d60e972865e6258c2f8c145a7
-
Filesize
40KB
MD5a3caa9963c9133c2a14a4e36d62761e3
SHA17034faaf46b2fe7c36370eaf4677357bb0950a57
SHA256f628edfece15db0061fdfe96724266a3cfaaec396524a94b574e22e6e3970c40
SHA51290212e732a55b7d478ff4e5b629ac950656290cb81500ba47d8282091963899b15117d0ce4db36f9bfe4ab93235374f797aa09d4f20f70f156458e9911867301
-
Filesize
17KB
MD5596b69069bbbcc9a22ac26bba6efe546
SHA1694cec54200ff1ec70dc56320c577b652884b53d
SHA256830db4be4c8320f23ff32316dac933d4e72d9056ea5a819cc12c38614da6e06f
SHA5121c18acf4403915c6a2562f5e26c0ed7c4fc00e9d67d19622d1db8bb9338ff6d6e8bf9abe7317f1b529ef1c24901b45c3b13dc3b734d97582c91b206bee9aa8f8
-
Filesize
556B
MD535f4753a58432446b99bf89a9e930bf5
SHA1babc3341d9d95865a36ea9a20549a61146093006
SHA256e4659306a755b583e9cef5fdba3b3eb102d8939fb028afd91aad4496e758fad5
SHA512ac3483a17ead5173ce40a6af55c3c2361652fefd94c0bd82e004df8186ffc31eab194534a25fe995d677f2f71363095d177c01afb6ae50f2b63ba156855ef5e5
-
Filesize
2KB
MD50299132478b49e3eb706c214bf32e62f
SHA19705c410b9f515269c512c64129ced8e0b1b23d2
SHA256d26caef44190e0b612c3e4309ff6689dc2953c72cb3de1c94d002250b089f16b
SHA5122a9ce8ee71ab207dbf4c4fcc2634d49233304da858c7880813a2127c2a063dc58703d4b2129498db630d081e1d72f899d348c01dbbcc359d92ab720b89ccdc44
-
Filesize
6KB
MD5669bd791c5aafb60ee0885ef064d3622
SHA1acefb3c3997e2eadd32413814e71aaaad5a8b6d4
SHA256e8c0b4e149ad58c57e77aac12041f1fa8bc9f25c6d642d12837efc5fd97b8d21
SHA512eb0345b3562523c58894752276938c7e5ee63b7c3a660317c9a4c1a93b6e530b12015dd380a8a230324b94a9f042380c1a1d24b49d21c3805a4711cb185a33db
-
Filesize
8KB
MD582eb574294ff4e2e7461b95f5bad0a87
SHA1a981373ef3bd61ce5a2f0ad9bedaa1cf4acfd591
SHA2567263286eb3a42eccf5edc39b43c74a8bf7c82f2671204d1ae654236c1de3f05d
SHA5121c54e110b384d55ca0243ad343e69d1f0fa9b2a863af8da75a5c992d19f9e055182bba09be227882f82d0ebf4ec94094723e2db06cdf7ee2ed574348a8d72c74
-
Filesize
8KB
MD557dcc5f7853cfd0bdd49f35d1f86897b
SHA1e7cc5a9f5f689054469c670cd4efee2889d26968
SHA256179c96d787fae5dd26cdf832e5226142ab3e4f1ff53e3b1f24cecddcf3e79947
SHA512742fcfffa94752fcdb37b28749c9fc7e43f1e467470fb3fe59aaab2a29fbecbe29ab113481fc5d009ada059975bba00d294442ec13437cef588179b7e88fb116
-
Filesize
10KB
MD51b88198b4bd36eb25e23dc412321a555
SHA1d3b5670d1bc7343ae40ad087bc22309dc17e118a
SHA25631249ef15cce83d150a9a5de11168a5052ff2c55dbd574b8df1c054510b61843
SHA512409fb90d7ea768c9d9a2574c09b8a69c93e8afd76234c24e3e0f71aa3f564a4f1aa46ff18ea328b1afccab54604bb239d37249d5811e3a84f0ab692b032a732b
-
Filesize
7KB
MD5dd3f9c2f9115689f4350896752f15926
SHA1fa19f1632b865b2bc098611a8be66e9f10dc692b
SHA25668b114a2ea4af9df54709a78ec5991a1f271097b29cb93757403fdb158746bc7
SHA51212f34d5ec7a7d5452eef97e4c87093240050756c564140874d316d0b9d194c961debe139badc943b024b680b68961ef6cbe71fc1a567c6622797f90ed51fa549
-
Filesize
2KB
MD50fe4932669e99a498a7bc76975919000
SHA1e0d6a7b484d3a6c0d7427f611c575f93e4f87ba4
SHA2561e09fc4af5dc3e673d4facfe4fa849c6bdd0b29c67b0efd7f96aaf387fcef698
SHA512dd3b99739106953608ac2eb2ecc4e3d316b5122b1b305bd7cfab82fcc7ec0d92b5944f4724d37cbc01ca5c6b5381b57fad9256586b5dfd0026453f9c11a32394
-
Filesize
159B
MD5e5918a52b52ca3ce2e99788a26477984
SHA187c2b54b65663e1e29e866224faeed7e8bac759b
SHA256c1908cfc4b224b3bc8d1a5c67cfe4acdb4e738d8acf98560905afc412981c18b
SHA5124f320cbea5adfed4b07012e04281e8713689271932b26d3886e3519389b15e2adadb87217c5bf09b080d3db976c77accf555493b7eab5ceb45bc59131772f8e6
-
Filesize
17KB
MD5e3f2ad7733f3166fe770e4dc00af6c45
SHA13d436ffdd69f7187b85e0cf8f075bd6154123623
SHA256b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
SHA512ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
-
Filesize
1.9MB
MD55836544d903111b9f15f3007ecf24e75
SHA1562e99a9591b6adda5dc892b35923f6d99582fa3
SHA256e18dbc5445fcd079fdbb189ba53c48ccff8fb8723fca39c353e9c99fdee38b85
SHA512837aaf2d66c8a0964a6b979cbf0d90f64dd20996e59c771d7ea47b9bb949bc017b14585b07b137c0b60842f846004b53f5a5b1fcdf9c78dd8e38e8b60eed9283
-
Filesize
955KB
MD579df35982c6d7de66155a01505c00bf1
SHA1e9e488f574ffb40dd62922328c4edec07b3d1a0c
SHA256fe0b57163bcf3d4542d902570b48665523d9293090496f990bb76ed421173f3c
SHA512643e8e0ef47afa87f81fb995a9e5c6d58a8a57c7a824fe91f3ddcb017a867578c0ac0ad9f05435418b9645805a07b97487f814e09e125d77ffb6bc7ed3b8f147
-
Filesize
955KB
MD5c198b9c4d97c074aa7b355d19303142b
SHA1aae2f53d1f3cdee6d3c5deacfb5fdb2f0172ce46
SHA256d87056076fe633d53c45e2629587ffd5160abef56664a9cf3903968635537db4
SHA512ab9bc4dacd1432ad0bb4f6223e20569160387b59ef255f3b17849878e6688287ddb305a7e193688632f91ef381087c3762bad9e1806af63d616633282e9b9e2e
-
Filesize
1008B
MD5b3f3381e0af2758dad636d5694238efc
SHA1a09d7da06cdbee993feea9dc4c5b34d56887492c
SHA256f661de069365398de25f499a830badb063c77f0f755f710d56ccedf6c26991ad
SHA5120ba5404b7a4ab51baca53367eef05574c3e13ee74c5d7a8e831f4720801ba05d995c8b8a5933f568715fabb66b5e86a4809b2d1a06d0471ea80c70c985d2b072
-
Filesize
1KB
MD5d678b7a56e3bcc248532ef098c57d179
SHA17d1ef042a77d084f049d9282e7fe56cb5f5526ae
SHA256467b80c40816f50a435fad72c3a4950cb2d03d66cc816dbcc54a3869f3d95b20
SHA512be4f1b09264e651f867f172d92a0b36ee80f0ad75826acc35d25c44a25b0723620f398ecd7defd5367ce44a02bce21e57c9994be48bdf0fe81600dd638b2394a