Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ContactsCSVGenerator-v103.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ContactsCSVGenerator-v103.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target ContactsCSVGenerator-v103.exe
- Size 745KB
- Sample260608-wwhpfaet2k
- SHA256 914bc5ad76eb52b1105ae904ab613d5c689c5c51fa38d8ed40bd7a3c1eeb6914
- MD5 a521cfb90a699b7a693f7fa979574673
- SHA1 9340c5d876c1e392c05d8841ee752a8756ee2c15
- SHA512 69f1de53d2bf7f7cabb11fe00d80c3d78649f594b7644df03eaafcb3df248abbcc2711c9d1cd2a3bc36726a0ff21078b739a969e55cfd82efa90e82c14b59080
- SSDEEP 12288:4MmMQFBRkmNoftiPk099JGX/S2ec4oElAEoN0bRB26xDKlT3oVTRcameaebkGG:vmDCNikCJG62A5BX2aDKlDoVTXm05G
- TLSH T1B9F412674B648127D3955B354073EE2E4BBFAF783C3AE203C89479B6BB3A3C60958544
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4508-1-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-4-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-5-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-8-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-13-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-15-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-19-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-23-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-22-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-26-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-27-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-30-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-31-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-32-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe behavioral2/memory/4508-33-0x00007FF6A4300000-0x00007FF6A4491000-memory.dmp autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c00434653461600310000000000ad5c9cbb120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbead5c9cbbc85c25922e00000041570200000001000000000000000000000000000000c97369004100700070004400610074006100000042000000 ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000ae5c7507100054656d7000003a0009000400efbead5c9cbbae5c75072e000000565702000000010000000000000000000000000000002e46b000540065006d007000000014000000 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell ContactsCSVGenerator-v103.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5000310000000000ad5cdcbd10004c6f63616c003c0009000400efbead5c9cbbc85c25922e0000005557020000000100000000000000000000000000000064cc2d004c006f00630061006c00000014000000 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff ContactsCSVGenerator-v103.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 ContactsCSVGenerator-v103.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff ContactsCSVGenerator-v103.exe Key created \Registry\User\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\NotificationData ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ ContactsCSVGenerator-v103.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg ContactsCSVGenerator-v103.exe Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ContactsCSVGenerator-v103.exe Set value (data) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots ContactsCSVGenerator-v103.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4508 ContactsCSVGenerator-v103.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4508 ContactsCSVGenerator-v103.exe 4508 ContactsCSVGenerator-v103.exe