File name:

autoit-v3-setup.exe

Full analysis: https://app.any.run/tasks/2a781c7b-068e-4e4f-8527-6db7b528668b
Verdict: Malicious activity
Analysis date: February 25, 2024, 13:10:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A65B5DF1A846FB0BB7AD4B2DA19BBBCD

SHA1:

B93C659C6F9ECA5CDAEA8E552C0466CAC3EA61D6

SHA256:

19F91EE8A2ACF408D69BE07E1C4A99992213E565B9C8BB6D5C52F59F79707DA3

SSDEEP:

393216:TDaWWhLNL186VkPwBOf74ycQf2TftfJBYT6IL/owfe:TDaWWdNxpg2icfRC7L/xm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • autoit-v3-setup.exe (PID: 2844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • autoit-v3-setup.exe (PID: 2844)

    • Creates/Modifies COM task schedule object

      • autoit-v3-setup.exe (PID: 2844)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • autoit-v3-setup.exe (PID: 2844)

    • Creates a software uninstall entry

      • autoit-v3-setup.exe (PID: 2844)

    • Reads the Internet Settings

      • hh.exe (PID: 2892)

    • Reads Internet Explorer settings

      • hh.exe (PID: 2892)

    • The process creates files with name similar to system file names

      • autoit-v3-setup.exe (PID: 2844)

    • Reads Microsoft Outlook installation path

      • hh.exe (PID: 2892)

  • INFO

    • Create files in a temporary directory

      • autoit-v3-setup.exe (PID: 2844)
      • hh.exe (PID: 2892)

    • Checks supported languages

      • autoit-v3-setup.exe (PID: 2844)
      • AutoIt3.exe (PID: 3800)

    • Reads the computer name

      • autoit-v3-setup.exe (PID: 2844)
      • AutoIt3.exe (PID: 3800)

    • Reads security settings of Internet Explorer

      • hh.exe (PID: 2892)

    • Creates files in the program directory

      • autoit-v3-setup.exe (PID: 2844)
      • hh.exe (PID: 2892)

    • Checks proxy server information

      • hh.exe (PID: 2892)

    • Reads the machine GUID from the registry

      • hh.exe (PID: 2892)
      • AutoIt3.exe (PID: 3800)

    • Manual execution by a user

      • explorer.exe (PID: 2168)
      • AutoIt3.exe (PID: 3800)

    • Reads mouse settings

      • AutoIt3.exe (PID: 3800)

    • Creates files or folders in the user directory

      • hh.exe (PID: 2892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.3.16.1
ProductVersionNumber: 3.3.16.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: AutoIt Team
FileDescription: AutoIt v3 Setup
FileVersion: 3.3.16.1
LegalCopyright: @ 1999-2021 Jonathan Bennett & AutoIt Team
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start autoit-v3-setup.exe hh.exe no specs explorer.exe no specs autoit3.exe no specs autoit-v3-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2168"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2472"C:\Users\admin\AppData\Local\Temp\autoit-v3-setup.exe" C:\Users\admin\AppData\Local\Temp\autoit-v3-setup.exe—explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Setup
Exit code:
3221226540
Version:
3.3.16.1
Modules
Images
c:\users\admin\appdata\local\temp\autoit-v3-setup.exe
c:\windows\system32\ntdll.dll
2844"C:\Users\admin\AppData\Local\Temp\autoit-v3-setup.exe" C:\Users\admin\AppData\Local\Temp\autoit-v3-setup.exe
explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Setup
Exit code:
0
Version:
3.3.16.1
Modules
Images
c:\users\admin\appdata\local\temp\autoit-v3-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2892"C:\Windows\hh.exe" -mapid 1000 "C:\Program Files\AutoIt3\AutoIt.chm"C:\Windows\hh.exe—autoit-v3-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\hh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\hhctrl.ocx
c:\windows\system32\user32.dll
3800"C:\Program Files\AutoIt3\AutoIt3.exe" C:\Program Files\AutoIt3\AutoIt3.exe—explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
1
Version:
3, 3, 16, 1
Modules
Images
c:\program files\autoit3\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
Total events
12 183
Read events
12 116
Write events
64
Delete events
3

Modification events

(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AutoIt v3\AutoIt
Operation:writeName:InstallDir
Value:
C:\Program Files\AutoIt3
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AutoIt v3\AutoIt
Operation:writeName:Version
Value:
v3.3.16.1
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.au3
Operation:writeName:PerceivedType
Value:
text
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.au3\ShellNew
Operation:writeName:FileName
Value:
Template.au3
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
116
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_CURRENT_USER\Software\AutoIt v3\Aut2Exe
Operation:writeName:LastExeDir
Value:
My Documents
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_CURRENT_USER\Software\AutoIt v3\Aut2Exe
Operation:writeName:LastScriptDir
Value:
My Documents
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_CURRENT_USER\Software\AutoIt v3\Aut2Exe
Operation:writeName:LastIconDir
Value:
C:\Program Files\AutoIt3\Aut2Exe\Icons
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_CURRENT_USER\Software\AutoIt v3\Aut2Exe
Operation:writeName:LastIcon
Value:
(PID) Process:(2844) autoit-v3-setup.exeKey:HKEY_CURRENT_USER\Software\AutoIt v3\Aut2Exe
Operation:writeName:LastCompression
Value:
2
Executable files
23
Suspicious files
38
Text files
2 831
Unknown types
4

Dropped files

PID
Process
Filename
Type
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\AutoIt.chm —
MD5:—
SHA256:—
2844autoit-v3-setup.exeC:\Users\admin\AppData\Local\Temp\nssFA50.tmp\ioDefaultOpen.initext
MD5:8C032D104411DA01E43D8E8B9AD88EB4
SHA256:659CAD01FE631A96E0856C44D4114E12AC0E5402F863C2B1213A87D375C26F59
2844autoit-v3-setup.exeC:\Users\admin\AppData\Local\Temp\nssFA50.tmp\InstallOptions.dllexecutable
MD5:ECE25721125D55AA26CDFE019C871476
SHA256:C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
2844autoit-v3-setup.exeC:\Users\admin\AppData\Local\Temp\nssFA50.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\AutoIt3_x64.exeexecutable
MD5:8FA52F316C393496F272357191DB6DEB
SHA256:92C6531A09180FAE8B2AAE7384B4CEA9986762F0C271B35DA09B4D0E733F9F45
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\AutoIt v3 Website.urltext
MD5:7B6871AD1DE81E0201386EEB8A71498F
SHA256:A8697C79934FF08407412D2C0C0492217709841638F1FD7FC6D8A68C105EED0B
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\AutoIt3.exeexecutable
MD5:0ADB9B817F1DF7807576C2D7068DD931
SHA256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\Include\APIDiagConstants.au3text
MD5:92A85EA19C1232CFB98A49F5452E441A
SHA256:6F8114A19A7992C7263687BDBF7B6E03A858930C1DAD8879BCB02E2B08AE78AA
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\Include\APIConstants.au3text
MD5:D5F18016A7569C1081BB364AF69585EB
SHA256:C2BDCD859CCD65B7F482E0DEA9B24B50298655EDF6DBF8812C446E0136818FEB
2844autoit-v3-setup.exeC:\Program Files\AutoIt3\Include\APIDlgConstants.au3text
MD5:4DBC76266581B3F3C3E27D9389C4FD3E
SHA256:8E52BD522CCFD39240061D9B8D8861E0F50896D351038A1A4D72146E2AB6862A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
autoit-v3-setup.exe