Overview

overview

6

Static

static

5

AutoHotkey...up.exe

windows10-2004-x64

6

AutoHotkey...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    10s
  • max time network
    14s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AutoHotkey_2.0.28_setup.exe
  • Size 2.9MB
  • Sample261001-sl8lbsty7l
  • SHA256 aca3f50a66ac4c6fcee5bd168c90929c70f3ea9e12fc62b6699a26ea1e087dc3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojanupx

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 6 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 49 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.28_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.28_setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.28_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.28_setup.exe" /to "C:\Program Files\AutoHotkey"
      2⤵
      • Drops file in Program Files directory
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5364
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check
        3⤵
          PID:3220
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3912
      • C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
        "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk
        1⤵
          PID:2736

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AutoHotkey64.exe
              • Path C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.28_setup.exe\AutoHotkey64.exe
              • Size 1.2MB
              • SHA256 373181727d1ae858564d4daa678f9fa6cf330d1751f8b284a369c79afdb05e98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WindowSpy.ahk
              • Path C:\Program Files\AutoHotkey\WindowSpy.ahk
              • Size 159B
              • SHA256 c1908cfc4b224b3bc8d1a5c67cfe4acdb4e738d8acf98560905afc412981c18b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AutoHotkey Dash.lnk
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Dash.lnk
              • Size 1KB
              • SHA256 dbbe984a880ce189f4f6052d8cafe0c9f7cc33f8745f78994b193c3529ea6f4c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AutoHotkey Window Spy.lnk
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Window Spy.lnk
              • Size 2KB
              • SHA256 971c7eb19d38d6bca3541ef01a9bdb76d91ae057434f7b321f7dd2b43ae09ac3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4548-0-0x0000000000400000-0x0000000000957000-memory.dmp
              Download

              memory/4548-2-0x0000000000400000-0x0000000000957000-memory.dmp
              Download

              memory/5364-176-0x0000000000400000-0x0000000000957000-memory.dmp
              Download