Overview
overview
7Static
static
6Kid Pix 4/...32.exe
windows10-2004-x64
3Kid Pix 4/...32.exe
windows11-21h2-x64
3Kid Pix 4/...ct.htm
windows10-2004-x64
4Kid Pix 4/...ct.htm
windows11-21h2-x64
4Kid Pix 4/...32.exe
windows10-2004-x64
3Kid Pix 4/...32.exe
windows11-21h2-x64
3Kid Pix 4/...in.dll
windows10-2004-x64
3Kid Pix 4/...in.dll
windows11-21h2-x64
3Kid Pix 4/...12.htm
windows10-2004-x64
4Kid Pix 4/...12.htm
windows11-21h2-x64
4Kid Pix 4/...eg.dll
windows10-2004-x64
3Kid Pix 4/...eg.dll
windows11-21h2-x64
3Kid Pix 4/...ude.js
windows10-2004-x64
3Kid Pix 4/...ude.js
windows11-21h2-x64
3Kid Pix 4/...de.pdf
windows10-2004-x64
3Kid Pix 4/...de.pdf
windows11-21h2-x64
3Kid Pix 4/...ct.exe
windows10-2004-x64
7Kid Pix 4/...ct.exe
windows11-21h2-x64
7DotNetInstaller.exe
windows10-2004-x64
3DotNetInstaller.exe
windows11-21h2-x64
3IKernel.dll
windows10-2004-x64
3IKernel.dll
windows11-21h2-x64
3IScript.dll
windows10-2004-x64
3IScript.dll
windows11-21h2-x64
3IUser.dll
windows10-2004-x64
3IUser.dll
windows11-21h2-x64
3ctor.dll
windows10-2004-x64
3ctor.dll
windows11-21h2-x64
3objectps.dll
windows10-2004-x64
3objectps.dll
windows11-21h2-x64
3DotNetInstaller.exe
windows10-2004-x64
3DotNetInstaller.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 20:04
Behavioral task
behavioral1
Sample
Kid Pix 4/Data/Players/SwFlsh32.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kid Pix 4/Data/Players/SwFlsh32.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Kid Pix 4/Ereg/Connect.htm
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
Kid Pix 4/Ereg/Connect.htm
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
Kid Pix 4/Ereg/EReg32.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Kid Pix 4/Ereg/EReg32.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
Kid Pix 4/Ereg/EregMain.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Kid Pix 4/Ereg/EregMain.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Kid Pix 4/Ereg/ThankYou12.htm
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
Kid Pix 4/Ereg/ThankYou12.htm
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
Kid Pix 4/Ereg/WebReg.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Kid Pix 4/Ereg/WebReg.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Kid Pix 4/Ereg/include.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Kid Pix 4/Ereg/include.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Kid Pix 4/Kid Pix 4 User Guide.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
Kid Pix 4/Kid Pix 4 User Guide.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
Kid Pix 4/Systems/AutoDetect.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
Kid Pix 4/Systems/AutoDetect.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
DotNetInstaller.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
DotNetInstaller.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
IKernel.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
IKernel.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
IScript.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
IScript.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
IUser.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
IUser.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
ctor.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
ctor.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
objectps.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
objectps.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
DotNetInstaller.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
DotNetInstaller.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Kid Pix 4/Systems/AutoDetect.exe
- Size 114KB
- Sample260415-ythb1abz7v
- SHA256 c500187ab0bafe03622c8fc4754915ed4cd36f643e691baf21c172c233660cc8
- MD5 cafb55aa463c6df8802122838d50d2bb
- SHA1 90054dfba153d69c426723121f2746d2aa18f912
- SHA512 e0d064db008543bf0d62ef93e60529393e7e7f1ff121f6e0cb7274a0ec981a3edeeb25cfb0a6564558aa8f6ed2750af39714cea3fd0bf3a5059f165b7a6813cf
- SSDEEP 3072:QAsBJ4EIukM38TrcAXJGnuMcwyBtJLt5Aa:zi4EIQ8ETucyVAa
- TLSH T1B2B33A1277E1807AF2F31731BD7526B14ABBBD311A38C60F5764264D1FB2AA5CA64323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 24 IoCs
pid Process 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe 4260 AutoDetect.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsProBE.tlb AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\cto7F37.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isc7F38.tmp AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isc7F38.tmp AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ius7F87.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp7E38.tmp\temp.000 AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKe7F25.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot7F26.tmp AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot7F26.tmp AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP7F88.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsProBE.tlb AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ius7F87.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj7FD7.tmp AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj7FD7.tmp AutoDetect.exe File created C:\Program Files (x86)\InstallShield Installation Information\{D9BF6F1D-0EE6-4CE0-BA60-78E32DF12AA6}\_setup.dll AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\set7DB9.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp7DB8.tmp\temp.000 AutoDetect.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp7E38.tmp\iGdi.dll AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKe7F25.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\cto7F37.tmp AutoDetect.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP7F88.tmp AutoDetect.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoDetect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoDetect.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1ED19966-1493-4539-B9F5-97A6556CE8F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib\Version = "1.0" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E156322-57D4-448B-BAB4-35DC0C7ADF53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{16344B6E-52E1-4BBC-AA79-E08B10B7BAB9}\ = "ISetupComponent3" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib\Version = "1.0" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABF74802-8E5B-44EA-880E-8E128A06A113}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D1BC05A-7056-458F-B605-A6298C8BD4B1}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\ = "ISetupCopyFiles" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61892D50-28EF-11D3-A8FF-00105A088FAC}\ProxyStubClsid32 AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib\Version = "1.0" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E67BBC9-18CB-4B22-BACD-687CDF6387B6}\ProxyStubClsid32 AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}\ProxyStubClsid32 AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61892D50-28EF-11D3-A8FF-00105A088FAC}\TypeLib AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21D98482-146C-4EBF-AF1E-B04395110005}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD0749C-12DC-4D2B-A4F6-9E52F0F38A6C}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084A0737-26B9-4433-8007-A9161333B5FC}\ProxyStubClsid32 AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\ = "ISetupDriver" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EDC2C10-66FE-11D3-A90F-00105A088FAC}\TypeLib\Version = "1.0" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\ = "ISetupObject" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21D98482-146C-4EBF-AF1E-B04395110005}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC3-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C5C8B37-CCB7-11D5-ABEC-00B0D0238DF5}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2084-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4AAC3B1-C547-11D3-B289-00C04F59FBE9}\ProxyStubClsid32 AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{787D0980-F63F-462C-86BC-FC23847C70F4}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D795704-435D-11D3-88FF-00C04F72F303} AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4D3EAE5-8A3A-4376-8B65-6A81293EDB1D}\ = "ISetupScriptController" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303} AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9} AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5469EE67-1493-402F-8E2C-99936C9E4983}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA} AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{787D0980-F63F-462C-86BC-FC23847C70F4}\TypeLib\Version = "1.0" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4817E4B-04B6-11D3-8862-00C04F72F303}\InProcServer32\ThreadingModel = "Both" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084A0737-26B9-4433-8007-A9161333B5FC}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{16344B6E-52E1-4BBC-AA79-E08B10B7BAB9}\ProxyStubClsid32 AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\ = "ISetupReboot2" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084A0737-26B9-4433-8007-A9161333B5FC}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B288F47-79AB-43A8-8494-D9F4D5985B29} AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8D5B971-D521-4113-82D6-869817B452DE}\ = "IMSIMsgHandler" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ED19966-1493-4539-B9F5-97A6556CE8F8}\ProxyStubClsid32 AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib\Version = "1.0" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2A3A842-FBA3-49D4-8806-7734716364A2}\ = "ISetupMedia3" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\ = "ISetupShellLink2" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{787D0980-F63F-462C-86BC-FC23847C70F4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD0749C-12DC-4D2B-A4F6-9E52F0F38A6C}\TypeLib\Version = "1.0" AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6494206F-23EA-11D3-88B0-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AutoDetect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib AutoDetect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\ = "ISetupCABFile2" AutoDetect.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1812 wrote to memory of 4260 1812 AutoDetect.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kid Pix 4\Systems\AutoDetect.exe"C:\Users\Admin\AppData\Local\Temp\Kid Pix 4\Systems\AutoDetect.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\Kid Pix 4\Systems\AutoDetect.exe-deleter2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4260
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
- Size 5KB
- SHA256 4f9c15127e16eae3a7ddaed55817fb549ed31168f9861285c9349c468b260579
- MD5 f89558047e71f655a4ddb99e893213ed
- SHA1 68a0cd5af1aa62c46e965e8e5c85c33de4d4678a
- SHA512 6ca5e7ba0db836f88685868d0788119fd441f47972907727f4eb711955f63cc74e3e818b93069a1c2baa5c49e387978acbe8ecfbbbc1723a7f40f4c0e41dac45
- SSDEEP 48:67ndi0X7JBqVKk5YCfpZBAv8GPTUc4gQ+fzK/4hotiufsV5ZYNunoIwo8iwegMqu:4di0X7J0VJyopUwUQ+u/4FqsZYfNBsC
- TLSH T15AC17545E7E88336FDB78F3EBD7337824675BB108DA2976F05CE010A6C256608961B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
- Size 68KB
- SHA256 9620bdd78c1cad92a2118eab21e4dfa0ec8e9b59673adb84f917331b78402ad0
- MD5 66cf4f30f925485e00191c16d00038c4
- SHA1 80b576f6e5eebd5577cde81cbd6394136b9f08e6
- SHA512 18072bdf7ab50132a08d620b5571c4c8ecb245124d91ebfda5cba1aac4fc41e020ae037cd7a49cfd119978b91c628428e85d2e7bf7ef362d319d9451e6c62cf3
- SSDEEP 768:6mb6ReJQ+khADnEq+nZ15J8+DxhOHGyXClJS1NVCGJBVVgyw0oTH0w9nnbH67HIa:6q6ReJQlA5o0AhX7YnnwPJr67n
- TLSH T145633B1B23E3C5F1D7972332BB592B5E217E6E1531E1A3168F1349E32C3262BD662907
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
- Size 184KB
- SHA256 63671696aa87c0862e6381bc759116cd377c5331ab50ae6d05ba7cd29cf02580
- MD5 298c79ac2f609736788cc7cacdeeef32
- SHA1 1cce1dcc23a941e650edfeaa7de59327fa452ba2
- SHA512 29fc496780a4fdac6a8c4af6b737973019e3087b5d3d8fe8625d4ce1de88e437eea0254d8900934846c6519ce0bffbcddfe1aa01cf5736b47dba58f06071fe23
- SSDEEP 3072:QYHma2vpbx5asru0aotKiaSk7uH0pT/sm8yoHKrHpZkmJbGcLB+XGLkh:QYHmJx5aslJaSkikH/DN7ggkh
- TLSH T198049E0478E0C13FC7AF0272B9AB6F75E7FCE5210FA5458B97580E4C5F75A868A22247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
- Size 712KB
- SHA256 cb29c9091d22a94e1aa72a6f2a83e01013e5148d8dcfba8c90d2cdbd6d9b6e48
- MD5 1ea0c41b4f2f0e807700f9a72d99ac05
- SHA1 65c693fd17be74d1c8dfeadd591f3c3408ae321c
- SHA512 3f4e80bd8d3808fb76acef835c70cc00503acf38f13d3cec54bbf9cf87343a4c1d148a146fa432ca884eaf3c327e199c17432c91f6d6424fb3c17890255feda3
- SSDEEP 12288:7iG5h/LslnIaEd+NFwwPlpFlkjjFV43j9qPA+6KaT+NBblHcIfzFptT:7iG5lwlIFUwwtpFlkjjFV43j9qVD++Nj
- TLSH T1CCF47E1335F8C125F28E0132EA2C9BB8A2F9DB654D3059473B488A5D6F75AC6C127F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
- Size 260KB
- SHA256 a1c284e21ca49ef189e98e7847826556e64185c5542bd50c75ee30b25ea3d08a
- MD5 84cfe010fd3403ad28835bb500a1a81b
- SHA1 c57afea136a09266eae1af92bbd53d7c0b084ea0
- SHA512 fce50dea91d5e34b6ede4a6dfa4978648062b0eb6fc167f12925002521674d513e978552b46ff3e693ae819bf695367d2fda70d5ee8e6fc7f44d205893e31ccb
- SSDEEP 6144:TvOq2nKzn8ppgfI1ueM6Htmr3CTtJLON1:TvOq2KzCpgfI+nrUI
- TLSH T1AB447D1239B8C575C7DE0B31FA9A3F68A6FDE2248DF288430F594E1CDE37A45851252E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
- Size 188KB
- SHA256 c25957200e1390b6a5facb4b1c52c55a8690bd3ca63dbb2f2cc770510e74448e
- MD5 b54e00b79373514e838220436bd3f275
- SHA1 9cea61a706a28439574d8f1aafe40cd040f5e156
- SHA512 8efba669069d41c16e059cdf9bc74944e858b40e07f82a8160a3522e95ad770ab620bee78e0b10a184f31744931aeb790f4dcd4b895617875537ebd29b40a848
- SSDEEP 3072:rR5V8qXjwUr2evAytiDQ6Vfo/x67VSKxE3hzHwJO4co5Ht/H157:95j8UrTtIuxmbxUrNYD/b
- TLSH T17214AE127AE0C47BD29B0132BF6B1F69B7FDD2448FF459878B100E9E9EB1946C422617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
- Size 304KB
- SHA256 ad010c642f2bb264c69c153dcde78daa0bbf4699155f22e16641bba82158e7b1
- MD5 369ecaca6c59265f47d234da8faab871
- SHA1 162bf1cb2d201766e4f0fa52dbeddd603eca9a21
- SHA512 3430ccc7c78633c860c29778a0b854d5acf52b65283e88f18cad51796ece59cee1b2b040ffebd50a6ea52d2ce88836a06c136b92d7efc97e75ce8989d7571392
- SSDEEP 6144:Ufc+V0TDWWyl1xqfFk/spCgW4DHV5FsK6YrX81jjOuuwML9j:lo0TDWW8Ig+yU5
- TLSH T1F664190366FA453AF2F72B30A97B1B655EBFBE615A38C04F4385194C1C71AA5CA34723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP7F88.tmp
- Size 101KB
- SHA256 0858229878facde89776f9e4ec61e45cf14eca0bb6be9123234a9dedd0119c1a
- MD5 fcd8f741b79248a1a25937cdc780ebc4
- SHA1 f66ae868a445d4b802bfa369eff485f52b78782e
- SHA512 c1854935c69b9c90ed8ffc8c8b9bdaf3dbbe5cafd835adf5732f19c1736b1b47e04842d3cf4cb0e813c39450c4c55f830145b196e8eb781465950b5c668aa3f0
- SSDEEP 1536:ZEu4E2yFOSmAtonyhTwxv6F9ar1VqFtIqNG1lD+7NglO5/U:ZD4ERFTtEeQ6FfAzO5/U
- TLSH T1AFA35282FB82CAB3C40D0631581B63E61FB1E45A2E13B7573789536DAE733C1BB46664
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
- Size 32KB
- SHA256 b2278ce559b4d4cdce30c6b44f3664d1a6d1a5f0d9e1d99b87ba14bdcf31f4c5
- MD5 f935e7f618e9fab282302c0951545417
- SHA1 e04ea46a0445d78580839102164602a24e581464
- SHA512 4f0f11b35415ad8879bd182de17dfdc43045133bc11107254cffb8478508ec21a5400c707d66186e042bfef865ddd628d5526b0d32e4e08d7ef8ceabf9d49218
- SSDEEP 192:JnlX6cRWMxG4RMG180GoxMOSkA7sMC7znkDAa:B3B5Mcz6sMqgN
- TLSH T1E7E26412EAB659B1F68A40343C761577662D3C3148E9E073ABC2DD4E287D2F3856EB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_isdelet.ini
- Size 240B
- SHA256 ae21d86e5357599598e597d9a95ff46e3652089a783f7784c97209902a49691c
- MD5 30f4da27c35bedcfcceb4cae772da6bc
- SHA1 873084dec7a7cbe4fad793749527bb89011d5270
- SHA512 beae4e37f5e281b7989933c5c05a4d67bd63c8f8aeeaf2ce242d10f7a2b305301887909ff1e5dc61483797ab632366553f1defd7053f522669dbc5dbbb305f02
- TLSH T12BD0A55057C2C7DC2104B50317F5551E49B6DD48774567318B05F40939C5D1DB4D53D3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\isp7E37.tmp\_Setup.dll
- Size 156KB
- SHA256 fe4d8fe1a8ddd78dd0660fe425a37c535b21ef0bdfb86cb69a8b79af2bda5a8c
- MD5 9166f9460e0732d453805576be85c714
- SHA1 933c4dd87a9a73f6ee3caf47db8225a3e820b4b2
- SHA512 4c2d64fc44c9503a0823657b793bea0e06f0fc5b30e46d4448179361a34f0b8ed33837e1a39bf5ff395873752b0b2e62df8ddc968726bff61b57ec463b4acf8c
- SSDEEP 3072:2b9YfMX0E9QsJB9cWe7Ka2coNfCp5CYLQfnlS6LlwYKU:2Klua8NfCp5C4S
- TLSH T10EF393419A9B858FF3AFEA35C8B21EF88FD13D9EDB7145747896B12C24386605806F0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\iss7BC3.tmp\setup.ini
- Size 435B
- SHA256 d36a0b753d02946a4dbd39c87d4c5ac87679c31ae45af3f69fed35234f3c0005
- MD5 966fe8eb0aefb035d4444d5851b16ee7
- SHA1 062f08f7f0d75fc4a14ff8d7bbaab69990e82579
- SHA512 d773dba5f6dadfcc1e1af4badd8309ff9f1bb40c8643e6297ccc1071a0f665d0b0c19b8c4c0877eb6934d1c017562d76705a40d8060eec306fff6f1f7fa9f731
- TLSH T12BE08173912C98BA28850FA03432124067C02A9C854CC98883C4182EAFE7D38FE29A07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5BBF05A5-CDB7-4B15-BF6C-A39C10C7FD59}\{D9BF6F1D-0EE6-4CE0-BA60-78E32DF12AA6}\_IsRes.dll
- Size 292KB
- SHA256 a7ae6c7562b832282e0d5d3171f796bc404e32ecb0df316c462dd05b1fa48e6b
- MD5 3b1853234fb054d5028289be3d47bcbc
- SHA1 468e7b2dd16f8b74fea7189b5406ac3aad6c763e
- SHA512 c4af8c342ea27a2841199d2a7e37d60ef817bd9100a835e2c3aa49af1844f86eeb017a59b716b6e59f41452de5b2a1358520e250d261dd2a2d2ea0083c4e0f94
- SSDEEP 3072:UFnCQcMskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2cxDAYoBfkonHRf:U1nskkkkknffCp5CrRKluat8HR
- TLSH T12D546201E7EA814FF2BEAB34DCB11AA54FB23C56DA34C63D7A99710D1471A909C21F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5BBF05A5-CDB7-4B15-BF6C-A39C10C7FD59}\{D9BF6F1D-0EE6-4CE0-BA60-78E32DF12AA6}\isrt.dll
- Size 392KB
- SHA256 bea0a8f8454b94bd4cb2bf35a5363e538f816fdddd1d231358703d005faee17e
- MD5 ea8a40913840238aed96eeb9dc19af1e
- SHA1 8f94967525d852a5aaa1fb5ef8cdb20a98709877
- SHA512 94973dca8cb25abd65c83ba2a680b3fab4ea7401f2d2b28f95369f678fd15f134d7d1dcbc812f285d30ab8003765928ccbd11d3924d2363f4a6f25d5b3df969a
- SSDEEP 12288:svy9vtLXxLR11fcZlgUFPZYDMkS0GazZfOfyBISxT:sKvt7xNcPnvadGKBdxT
- TLSH T1EE848D01F6F5C53BC26B0134FB296FE9A3FC56251D619883DB944A5C2F73982D326A0E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5BBF05A5-CDB7-4B15-BF6C-A39C10C7FD59}\{D9BF6F1D-0EE6-4CE0-BA60-78E32DF12AA6}\setup.inx
- Size 172KB
- SHA256 6491239a0a193557f96c3910a5ab217c42bc4434f5d922f327ed5d787754f541
- MD5 7b2cb15c3090d5329edef97332eda225
- SHA1 1f90bbe1b2e90e44e4a81f0da4f4b2b8f1b7ebaa
- SHA512 27a1e1f4fc1d6b7f59337ea616bd0336f6f1b756d450411c2c93778c551c4ad30993f989fe55da166b72eea705f4028e2e5a2412ed5cf6af87a8c78fb510cf30
- SSDEEP 3072:jM2grKTXmbAgX1VtsqaaqJY0sOTNEbdHBEYXpYIMxUlxiasojznl:jAOqBztG24TNW0ANIXoPnl
- TLSH T12804AFA84E960F8E7328CDE6F43709D079C5EC4DA1E445E793A2C6D08F394FA50ED19A
- MD5 SHA1 SHA512 SSDEEP TLSH