Analysis
- user interaction
yes - max time kernel
183s - max time network
186s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 18:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
AyuGram.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
600 seconds
General
- Target AyuGram.exe
- Size 199.1MB
- Sample260420-xe4e9acw8p
- SHA256 794dc30c028192243963ba1dc4d9f7c8b080274a92af2659212dab344f2e8532
- MD5 ff43b556968212d48c20241372469cc1
- SHA1 2d95e37b4a8d683bd11e713b2562ce48a7573920
- SHA512 0f75fea5e89221716230f4f929eea916bf8aee6719ce9341d75c9f312b9cd39d647e08c0af79539e2c8b0a73d71637fd5afe0398fb26222489fc711aad2b5148
- SSDEEP 786432:4AG6ZoE5bRzekGaBEfP9Sf8uq67nmeP3jnl+ZonVLBtrtut5cX7CYFpF:4v6ZoMFykpBQVSfecnT+Z2Lp6yr
- TLSH T1AAA85BE5B11401EAE0E0E1388954D523E7F9354453A38ED7307BAA311D67AE9FE7E3A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini AyuGram.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct AyuGram.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AyuGram.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AyuGram.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ AyuGram.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AyuGram.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily AyuGram.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe,1\"" AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\shell\open AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\DefaultIcon AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\shell\open\command AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\URL Protocol AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\DefaultIcon AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\shell AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe\" -- \"%1\"" AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\shell AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\shell\open\command AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\shell\open\command AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe,1\"" AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe,1\"" AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\DefaultIcon AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\shell AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\shell\open AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\shell\open AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\URL Protocol AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\shell AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\shell\open\command AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe\" -- \"%1\"" AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\AyuGram.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe\" -- \"%1\"" AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\shell\open AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tonsite\ = "URL:TonSite Link" AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\ = "URL:Telegram Link" AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe,1\"" AyuGram.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\DefaultIcon AyuGram.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AyuGram.exe\" -- \"%1\"" AyuGram.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4840 AyuGram.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4840 AyuGram.exe 4840 AyuGram.exe 4840 AyuGram.exe 4840 AyuGram.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4840 AyuGram.exe 4840 AyuGram.exe 4840 AyuGram.exe 4840 AyuGram.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4840 AyuGram.exe 4840 AyuGram.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AyuGram.exe"C:\Users\Admin\AppData\Local\Temp\AyuGram.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tdata\ayu_settings.json
- Size 2KB
- SHA256 f7993126fe2f86b1b63e2899c14bc7d66af708c559ab1ae13e39c713d1f374ac
- MD5 9ff504237ea30f591c1e3f400d9e4833
- SHA1 18679d1ac7f16bfbd79ff9c6edb7ccf5c17e23c3
- SHA512 251b6b1943bd787008227c5fb88958a3c3bc54240832161b5c6546bb9d601b14db9eedf31cc8d4ee6e658122c88d25e2a449628de39fad517c045089eaec3af0
- TLSH T1FB512611D8608CBE0DB4A17BA8657442CA67DB0F21415A2BB5FD40CE2F7B2AE3542AB5
- MD5 SHA1 SHA512 TLSH