Overview

overview

3

Static

static

3

ActiveSync...nc.exe

windows10-2004-x64

3

Autoit3.ex...t3.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    329s
  • max time network
    330s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-01-2025 10:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Autoit3.exe/Autoit3.exe

  • Size

    872KB

  • MD5

    c56b5f0201a3b3de53e561fe76912bfd

  • SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

  • SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

  • SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • SSDEEP

    12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

Score
3/10
discovery

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Autoit3.exe\Autoit3.exe
    "C:\Users\Admin\AppData\Local\Temp\Autoit3.exe\Autoit3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1176
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4984
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2580
    • C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe
      "C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3612
    • C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe
      "C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1592
    • C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe
      "C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1536
    • C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe
      "C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2264
    • C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe
      "C:\Users\Admin\Desktop\ActiveSync.exe\ActiveSync.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3512

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1176-1-0x0000000000A30000-0x0000000000B0F000-memory.dmp

      Filesize

      892KB

      Download

    • memory/1176-5-0x0000000008940000-0x0000000008A40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1176-6-0x0000000000A30000-0x0000000000B0F000-memory.dmp

      Filesize

      892KB

      Download

    • memory/1536-20-0x0000000004230000-0x0000000005F21000-memory.dmp

      Filesize

      28.9MB

      Download

    • memory/1592-17-0x0000000000950000-0x0000000000963000-memory.dmp

      Filesize

      76KB

      Download

    • memory/2264-22-0x0000000004130000-0x0000000005E21000-memory.dmp

      Filesize

      28.9MB

      Download

    • memory/2264-26-0x00000000007E0000-0x00000000007F3000-memory.dmp

      Filesize

      76KB

      Download

    • memory/3512-28-0x0000000004210000-0x0000000005F01000-memory.dmp

      Filesize

      28.9MB

      Download

    • memory/3512-31-0x0000000000A40000-0x0000000000A53000-memory.dmp

      Filesize

      76KB

      Download

    • memory/3612-7-0x0000000004140000-0x0000000005E31000-memory.dmp

      Filesize

      28.9MB

      Download

    • memory/3612-11-0x0000000000DF0000-0x0000000000E03000-memory.dmp

      Filesize

      76KB

      Download