Overview

overview

3

Static

static

1

automazemacro.ahk

windows10-2004-x64

3

automazemacro.ahk

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    automazemacro.ahk
  • Size 1KB
  • Sample260810-xp3ayawbrf
  • SHA256 4c34a664102f5f9f438c906466a920fd8538b3fb1ffb893e9590aba184d9c1f4
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discoveryexecutionransomware

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\automazemacro.ahk
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    PID:6120
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\automazemacro.ahk
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:5192
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ResumeRemove.htm
    1⤵
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
      2⤵
        PID:4892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,6467119737706985360,16346109803366179095,524288 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4428
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,2247361397945037196,4529981922590856719,262144 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
        2⤵
          PID:1116
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,5856120281887939867,2949688447384166118,524288 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
          2⤵
            PID:5316
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8326465423803060387,11433153374818768440,2097152 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
            2⤵
              PID:5116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,986886037195104592,551972549508420526,2097152 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
              2⤵
                PID:900
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,13488311970273687059,4404087656166944894,2097152 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
                2⤵
                  PID:5972
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,15408318168243721581,8558023537815638870,2097152 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
                  2⤵
                    PID:4128
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17179690618282863915,1319678256347203032,524288 --field-trial-handle=2368,i,3743049661396804834,5168225464598716940,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
                    2⤵
                      PID:5600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                    1⤵
                      PID:5044

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Edge Profile.ico
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                          • Size 70KB
                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SCT Auditing Pending Reports
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                          • Size 2B
                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                          • MD5 SHA1 SHA512
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                          • Size 38KB
                          • SHA256 74d051d1f09b98093d76d6e9edda9fb112c9c66884cdc1979b3c0bfaf1c9b434
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                          • Size 39KB
                          • SHA256 6a1b6b46f6b1495ec756e4f362ec1a98aa249aba2280fa2ad72b5afea216301c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download