Analysis
- user interaction
yes - max time kernel
82s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CIient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
CIient.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target CIient.exe
- Size 1.6MB
- Sample260729-v3bn2acb63
- SHA256 a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35
- MD5 7f4ce93930e8a11edbc5f4c541bacd1a
- SHA1 7885b0bfff6a373b82c229a5e8d9e2b20ae44e7f
- SHA512 886830a3015b8e67ce3f521dffdf8b9a20c9142377058b07ebbbd7dcdd3dfc6a474a4a2dd07604ea1522cd027a8aace6758cbecb858054f2ea068ab1a7d54ef3
- SSDEEP 24576:FXTV5JftJdWXSXgzsJohbSwxxmhROMcCGfr5tv6mEpvttGtzEif2qK4+ptR:xJfIXSXgzsKhbzMcCGjmtaCd4+p
- TLSH T14C7523E253E410AAE4FD977948FA8323C731FC4557B4968F2314D9CA0F226D47A307AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2920 AutoIt3.exe 5852 AutoIt3.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2920 set thread context of 5852 2920 AutoIt3.exe 91 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5688 taskmgr.exe Token: SeSystemProfilePrivilege 5688 taskmgr.exe Token: SeCreateGlobalPrivilege 5688 taskmgr.exe Token: 33 5688 taskmgr.exe Token: SeIncBasePriorityPrivilege 5688 taskmgr.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 2920 AutoIt3.exe 2920 AutoIt3.exe 2920 AutoIt3.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe 5688 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5688 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5204 wrote to memory of 2920 5204 CIient.exe 90 PID 2920 wrote to memory of 5852 2920 AutoIt3.exe 91 PID 2920 wrote to memory of 5852 2920 AutoIt3.exe 91 PID 2920 wrote to memory of 5852 2920 AutoIt3.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\CIient.exe"C:\Users\Admin\AppData\Local\Temp\CIient.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Brake.a3x2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe3⤵
- Executes dropped EXE
PID:5852
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
- Size 1.0MB
- SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
- MD5 8fa52f316c393496f272357191db6deb
- SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
- SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
- SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
- TLSH T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Brake.a3x
- Size 1.1MB
- SHA256 fc59862a646c538a5bab72f7a325923d8bd605b4d2008d00d69ff13ef104bbc1
- MD5 f7224166661a396c2ac2ddd204de60e1
- SHA1 572fefec6f26ef0b00d3d6efb332239a3a55fea6
- SHA512 a1b3b859c6fa7a42f9d43fe3c4304c1760af9dc6d4437d0ed1fee5fbc0cffc32a229a2e56d15419c9faf0ca7f096f0bbd3c86f969b2e4a3a254e5fa068122b3a
- SSDEEP 24576:PwuVQJnRJCvgxREzPJQhG/xxBmhYxt7Cb3r5kvxmhSx:oJnGgxREzPahGpJPCbKOg
- TLSH T1143533D39399559919FDDECB20FFC3B283B58D0712DAB94D9648EEC307192242E04EE6
- MD5 SHA1 SHA512 SSDEEP TLSH