Overview

overview

8

Static

static

8

myAutToExe...NS.vbs

windows10-2004-x64

1

myAutToExe...NS.vbs

windows11-ltsc_2024-x64

8

myAutToExe...es.htm

windows10-2004-x64

3

myAutToExe...es.htm

windows11-ltsc_2024-x64

4

myAutToExe...ll.ps1

windows10-2004-x64

3

myAutToExe...ll.ps1

windows11-ltsc_2024-x64

3

myAutToExe...ll.cmd

windows10-2004-x64

1

myAutToExe...ll.cmd

windows11-ltsc_2024-x64

1

myAutToExe...ll.exe

windows10-2004-x64

3

myAutToExe...ll.exe

windows11-ltsc_2024-x64

3

myAutToExe...LL.url

windows10-2004-x64

4

myAutToExe...LL.url

windows11-ltsc_2024-x64

4

myAutToExe...mp.cmd

windows10-2004-x64

1

myAutToExe...mp.cmd

windows11-ltsc_2024-x64

8

myAutToExe...xp.htm

windows10-2004-x64

3

myAutToExe...xp.htm

windows11-ltsc_2024-x64

4

myAutToExe...ll.cmd

windows10-2004-x64

7

myAutToExe...ll.cmd

windows11-ltsc_2024-x64

7

myAutToExe...ll.cmd

windows10-2004-x64

1

myAutToExe...ll.cmd

windows11-ltsc_2024-x64

8

myAutToExe...er.exe

windows10-2004-x64

3

myAutToExe...er.exe

windows11-ltsc_2024-x64

3

myAutToExe...on.exe

windows10-2004-x64

3

myAutToExe...on.exe

windows11-ltsc_2024-x64

8

myAutToExe...SS.exe

windows10-2004-x64

3

myAutToExe...SS.exe

windows11-ltsc_2024-x64

3

myAutToExe...MT.dll

windows10-2004-x64

3

myAutToExe...MT.dll

windows11-ltsc_2024-x64

3

myAutToExe...t3.url

windows10-2004-x64

1

myAutToExe...t3.url

windows11-ltsc_2024-x64

1

myAutToExe...ad.url

windows10-2004-x64

1

myAutToExe...ad.url

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    myAutToExe_2.16_src.zip
  • Size 6.0MB
  • Sample260705-h4xxfaew3m
  • SHA256 71ec0e783b2ed5cf8122bfe5d3ec3e7022f050bc5ca2f616940f56eef55914b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywareupx

Malware Config

Targets

    • Target
      myAutToExe_2.16_src/!SourceCode/src_ExtractIcon/SRC/ICONS.C
    • Size 49KB
    • SHA256 fc53f952787e5b14da4242a3757d77778abd480438c3df5931a3f3974bcf2d8f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      myAutToExe_2.16_src/Doc/Dealing with modified Au3-files.htm
    • Size 39KB
    • SHA256 af894938f5510b0d645f903b91f9e766145ceaefc576310a091ca3c1f5f5a04d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral3behavioral4
    • Target
      myAutToExe_2.16_src/Doc/Inject_au3/injectdll.bb
    • Size 3KB
    • SHA256 ac93daa200f2b88279118f1be860744c0ae0ff6c87c4f5c58b4cee1593b1cbd4
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      myAutToExe_2.16_src/Doc/Inject_au3/injectdll.cmd
    • Size 1KB
    • SHA256 4a6d9a39dbdb2726ad40592ac53e44aeb8f402e2d79de4dcedd373b7a0d8015e
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      myAutToExe_2.16_src/Doc/Inject_au3/injectdll.exe
    • Size 7KB
    • SHA256 d8e7d4b3d0334dc3704c1654303576a2bea3722786c3eb04de9158de2de56fb4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      myAutToExe_2.16_src/Doc/Inject_au3/src/InjectDLL.url
    • Size 63B
    • SHA256 85edba6916ccf8a1a22ec187a8775a81c027aeccd1de90173756a3dfd8376943
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discovery
    behavioral11behavioral12
    • Target
      myAutToExe_2.16_src/Doc/ScriptDump.cmd
    • Size 102B
    • SHA256 96776b3eec064027be1c7c60a1efdefc2c9102a93cd02c555a8883dcf863f864
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14
    • Target
      myAutToExe_2.16_src/Doc/regexp.htm
    • Size 17KB
    • SHA256 cc95662f78c31520f62f9e0346c9b961bdb90de5b05017a85346ed7698de6af4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral15behavioral16
    • Target
      myAutToExe_2.16_src/Shell_Install.cmd
    • Size 367B
    • SHA256 a9230a36107043677c29c34d6efb84ae09f7a0d5e2acfb5f282d8a2a68e402a0
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    persistence

    • Modifies system executable filetype association

      persistence
    behavioral17behavioral18
    • Target
      myAutToExe_2.16_src/Shell_Uninstall.cmd
    • Size 123B
    • SHA256 27087823d408b468310525eb84a2ffc7f48923e18a63fc1e24316d030524b164
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral19behavioral20
    • Target
      myAutToExe_2.16_src/data/AU3Stripper/AU3Stripper.exe
    • Size 140KB
    • SHA256 e10e1f149c4eba6b990e3315375ca2df8fc8fc69c9bbfd675949b8f502e31829
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discoverydefense_evasion
    behavioral21behavioral22
    • Target
      myAutToExe_2.16_src/data/ExtractIcon.exe
    • Size 51KB
    • SHA256 89c1fca16dcd5a3ba787ca04c74b7fb813d162d99a3656d86ddcc0229cc5bb05
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      myAutToExe_2.16_src/data/LZSS.exe
    • Size 10KB
    • SHA256 869bf0d02caf9b7e1372cedc791b11b60418dc88259aa3166b81b36f93d511f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      myAutToExe_2.16_src/data/RanRot_MT.dll
    • Size 3KB
    • SHA256 84ad1207c795f731ab928013fe377df2d0db66d8631b4bcf2c068746cc1f333e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      myAutToExe_2.16_src/data/Tidy/Tidy Docu+obfu-Patch/Docu Tidy for AutoIt3.URL
    • Size 82B
    • SHA256 f5f7193d8f7fb070eebedd2a5974745752b9df135263dbaa9e21d0fd7a3eb010
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      myAutToExe_2.16_src/data/Tidy/Tidy download.URL
    • Size 85B
    • SHA256 2bd9f37ba2fa6912168d800a74b3f17cd0a3bf412b35423d8bd93dc201cd6365
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upx
Score
8/10

behavioral1

Score
1/10

behavioral2

adwarepersistenceransomwarespyware
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
4/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
4/10

behavioral12

discovery
Score
4/10

behavioral13

Score
1/10

behavioral14

adwarepersistenceransomwarespyware
Score
8/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
4/10

behavioral17

persistence
Score
7/10

behavioral18

persistence
Score
7/10

behavioral19

Score
1/10

behavioral20

adwarepersistenceransomwarespyware
Score
8/10

behavioral21

discovery
Score
3/10

behavioral22

defense_evasiondiscovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

adwarepersistenceransomwarespyware
Score
8/10