Analysis
- user interaction
yes - max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 10:43
Behavioral task
behavioral1
Sample
GenP-v3.8.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
GenP-v3.8.0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
out.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target GenP-v3.8.0.exe
- Size 1.5MB
- Sample260924-msh2csbf55
- SHA256 6721aaaa5b8a0bbc1bc68797e6b5f32b65129896c4e2e082f995446f7a9b5f8d
- MD5 938f882042e92e36d1450813daa897ec
- SHA1 415e123f7d81cb813eff5d7fa17dddbd58920943
- SHA512 2acbb893831dd3f02d1b965ea9114092d93994632fd7b7f39fbebd648799275845e286ba909bd70bfd7c2930069fe2352c5a19cd47c1ed933843fd86c0aff0b8
- SSDEEP 24576:P0/wH2fMinErsWguWH1G7eQtT/ihLTMnNa2ETtyqfF8XAU4u6LRWEzvALfARFXGX:sW2frO1fWg7eQtT+LTMNa7YqrU4u6tBI
- TLSH T149652366F78093A3E1600330D9E7C708323AAE5EDA522AD771D976FE78FD3406117869
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/4136-14-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-15-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-16-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-17-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-18-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-19-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-21-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-22-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-23-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-24-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-25-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-26-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-27-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-28-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe behavioral1/memory/4136-29-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/4136-0-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-14-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-15-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-16-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-17-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-18-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-19-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-21-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-22-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-23-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-24-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-25-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-26-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-27-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-28-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx behavioral1/memory/4136-29-0x00007FF78F7B0000-0x00007FF78FACF000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff GenP-v3.8.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 GenP-v3.8.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ GenP-v3.8.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 GenP-v3.8.0.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 GenP-v3.8.0.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff GenP-v3.8.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 GenP-v3.8.0.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4136 GenP-v3.8.0.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4136 GenP-v3.8.0.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\config.ini
- Size 12KB
- SHA256 3ab83e3db417c0bb49fa6501b233ebd1cc32e6811bbead86c0087b2069c0257d
- MD5 70bbf8042222083d362ff48790eb2fb6
- SHA1 e6db33c305ca2757e5ceb32afd8af55dfadb88c9
- SHA512 54ce3d7749615e9f895053481d77672093cf66b2a7e1645a7a20b66a30f832d75041a2fc53b9c878ada91005e4206e1be646cfc856e724814e6da6d2fc0686c0
- SSDEEP 384:0oM5+Npwecd0K8vck/vcg+qNLaJ2ctKmm8hJ/l:0oM5+Npwe7nq2ctKa
- TLSH T15342C805C5D342B2CAE57E4E32717E932B3BF1CC95CE1351DB5A853E39D200492ABE99
- MD5 SHA1 SHA512 SSDEEP TLSH