Overview
overview
8Static
static
1AutoMail/AutoMail.exe
windows7-x64
3AutoMail/AutoMail.exe
windows10-2004-x64
3AutoMail/S...g.html
windows7-x64
3AutoMail/S...g.html
windows10-2004-x64
3AutoMail/automail.chm
windows7-x64
1AutoMail/automail.chm
windows10-2004-x64
1AutoMail/mx9x.dll
windows7-x64
8AutoMail/mx9x.dll
windows10-2004-x64
8AutoMail/mxxp.dll
windows7-x64
3AutoMail/mxxp.dll
windows10-2004-x64
3AutoMail/sample.bat
windows7-x64
1AutoMail/sample.bat
windows10-2004-x64
1AutoMail/smtpsend.dll
windows7-x64
3AutoMail/smtpsend.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
AutoMail/AutoMail.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AutoMail/AutoMail.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
AutoMail/SampleHTMLMsg.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
AutoMail/SampleHTMLMsg.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
AutoMail/automail.chm
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
AutoMail/automail.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
AutoMail/mx9x.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
AutoMail/mx9x.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
AutoMail/mxxp.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
AutoMail/mxxp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
AutoMail/sample.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
AutoMail/sample.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
AutoMail/smtpsend.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
AutoMail/smtpsend.dll
Resource
win10v2004-20240802-en
General
-
Target
AutoMail/AutoMail.exe
-
Size
196KB
-
MD5
d377c08d908b09383645c72d4625e0a8
-
SHA1
1970985cf0ce4122430e0631d8c0167f386cdee6
-
SHA256
8f5488ac85ae55f8ba2000a748974f28bda32522000196fc0e41124cd99d0d91
-
SHA512
235c7e7f52cd724c3ac312b4e9091626d1d32ad2454d1e6f5a4076df6d3176df36c4a4589acfb8283e18042ea4c958143d0da82e50b5c0a016d44986503871f3
-
SSDEEP
3072:q3kRfsJNWuOpLpM2OxAMc0plJtxUUT5+bvIIbQMSIJ5RfQPH:c0OUPVKNxh4hV1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoMail.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fmifycn AutoMail.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\fmifycn\down1 = "1021256" AutoMail.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2932 msedge.exe 2932 msedge.exe 4904 msedge.exe 4904 msedge.exe 4900 identity_helper.exe 4900 identity_helper.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe 1084 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 4904 2596 AutoMail.exe 82 PID 2596 wrote to memory of 4904 2596 AutoMail.exe 82 PID 4904 wrote to memory of 4264 4904 msedge.exe 83 PID 4904 wrote to memory of 4264 4904 msedge.exe 83 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 1436 4904 msedge.exe 84 PID 4904 wrote to memory of 2932 4904 msedge.exe 85 PID 4904 wrote to memory of 2932 4904 msedge.exe 85 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86 PID 4904 wrote to memory of 640 4904 msedge.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoMail\AutoMail.exe"C:\Users\Admin\AppData\Local\Temp\AutoMail\AutoMail.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.automsw.com/starting.html2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x74,0x108,0x7ffa191d46f8,0x7ffa191d4708,0x7ffa191d47183⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:23⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:83⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:13⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:13⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:83⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:13⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:13⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:13⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:13⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17685552763109390308,2795326610830570651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
5KB
MD5abc260e3c6e540655d7847f5b9d1d016
SHA1bf8d6921cbc4ade8f47d7bbb9cb024f8e69329d8
SHA2563a958cb9c2f910f631a70f7243f7a6de685ece50e300572226317a8c9d6b5a36
SHA512e1341d13523c5380ddafa57474e46a0cb8172ac5a0aa594f558089107030a37ee4c62c611cc802913f728113a51ce9f16cf9cba12228d22d19d1105cb054ba66
-
Filesize
6KB
MD5e0a31d0d3f60c53b36746ac0948bc397
SHA119df9fef656979f6a79ccaf32f414bc89dbd2c9d
SHA2562042725ce56993364660c7eaac3eef85f7c8138ba595bc1c6c167c3a4fdbe30d
SHA512c527b7850b790eac7e0295b8dee972b2195e5f64c357f9b3e77eca6b5329a2e59a3bad389537b0e9d8f2ba0b636a9eadbe51af8ec3064a1b95a811b6375a3134
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d4ad1c06f476835c89ff4102e916cd98
SHA119fa86b675d5ba6052fb445a7fdfbef3d65472d6
SHA256c4d20f3ae35d6d8c1468abdbe9694985c08c2aee61563675369a9a7b2bf2f08f
SHA512322e3ea5f7497e1454410d5130f6e94b1389f0542ab9f002e272521ef05ca3ed32de63fd524cfda6ea0e326def96fe488a0567b2397da993b80223092ea74fab