URL:

https://www.autohotkey.com/download/ahk-install.exe

Full analysis: https://app.any.run/tasks/ae4e451b-cac3-4384-a59b-9476b95cc5d9
Verdict: Malicious activity
Analysis date: March 01, 2020, 00:38:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2CDC74790EE4C21384B03F10F6041900

SHA1:

18C1714002FCF04D82C0053DF8C84192E7BBC578

SHA256:

31DFE1DD5B9281A0908752C44DF02D525F3D884C50E41FD24311E05D83273A96

SSDEEP:

3:N8DSLKwLknNRKN:2OLKwUDe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AutoHotkey_1.1.32.00_setup.exe (PID: 3172)
      • AutoHotkey_1.1.32.00_setup.exe (PID: 2696)
      • setup.exe (PID: 3888)
      • AutoHotkey.exe (PID: 564)
      • AutoHotkey.exe (PID: 2928)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3328)
      • iexplore.exe (PID: 3436)
      • AutoHotkey_1.1.32.00_setup.exe (PID: 2696)
      • setup.exe (PID: 3888)

    • Creates files in the Windows directory

      • setup.exe (PID: 3888)

    • Reads internet explorer settings

      • setup.exe (PID: 3888)
      • hh.exe (PID: 540)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 3888)

    • Creates files in the program directory

      • setup.exe (PID: 3888)

    • Creates a software uninstall entry

      • setup.exe (PID: 3888)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3328)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3328)
      • iexplore.exe (PID: 3436)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3328)

    • Creates files in the user directory

      • iexplore.exe (PID: 3436)
      • iexplore.exe (PID: 3328)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3328)
      • iexplore.exe (PID: 3436)

    • Manual execution by user

      • AutoHotkey.exe (PID: 564)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3328)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start iexplore.exe iexplore.exe autohotkey_1.1.32.00_setup.exe no specs autohotkey_1.1.32.00_setup.exe setup.exe autohotkey.exe no specs autohotkey.exe no specs hh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Windows\hh.exe" "ms-its:C:\Program Files\AutoHotkey\AutoHotkey.chm::/docs/Welcome.htm"C:\Windows\hh.exe—AutoHotkey.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\hh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\hhctrl.ocx
c:\windows\system32\user32.dll
564"C:\Program Files\AutoHotkey\AutoHotkey.exe" "C:\Program Files\AutoHotkey\Installer.ahk" /exec runahkC:\Program Files\AutoHotkey\AutoHotkey.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Unicode 32-bit
Exit code:
0
Version:
1.1.32.00
Modules
Images
c:\program files\autohotkey\autohotkey.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
2696"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\AutoHotkey_1.1.32.00_setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\AutoHotkey_1.1.32.00_setup.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoHotkey Setup
Exit code:
0
Version:
1.1.32.00
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\autohotkey_1.1.32.00_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2928AutoHotkey.exeC:\Program Files\AutoHotkey\AutoHotkey.exe—AutoHotkey.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Unicode 32-bit
Exit code:
2
Version:
1.1.32.00
Modules
Images
c:\program files\autohotkey\autohotkey.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
3172"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\AutoHotkey_1.1.32.00_setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\AutoHotkey_1.1.32.00_setup.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Setup
Exit code:
3221226540
Version:
1.1.32.00
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\autohotkey_1.1.32.00_setup.exe
c:\systemroot\system32\ntdll.dll
3328"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.autohotkey.com/download/ahk-install.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3436"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3328 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3888C:\Users\admin\AppData\Local\Temp\7z6FE8AA88\setup.exe C:\Users\admin\AppData\Local\Temp\7z6FE8AA88\setup.exe
AutoHotkey_1.1.32.00_setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.1.32.00
Modules
Images
c:\users\admin\appdata\local\temp\7z6fe8aa88\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
Total events
4 718
Read events
1 065
Write events
2 465
Delete events
1 188

Modification events

(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
3480296160
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30797665
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3328) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
19
Suspicious files
10
Text files
23
Unknown types
14

Dropped files

PID
Process
Filename
Type
3436iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab70F2.tmp —
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar70F3.tmp —
MD5:—
SHA256:—
3328iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6BBABE61ABD5C1E5.TMP —
MD5:—
SHA256:—
3328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\AutoHotkey_1.1.32.00_setup.exe.qcw5v5x.partial:Zone.Identifier —
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8QU1CQCK.txttext
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1der
MD5:—
SHA256:—
3328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{FB3017FB-5B54-11EA-972D-5254004A04AF}.datbinary
MD5:—
SHA256:—
2696AutoHotkey_1.1.32.00_setup.exeC:\Users\admin\AppData\Local\Temp\7z6FE8AA88\Installer.ahktext
MD5:F69C2AC693E9E4D6B8ED3935CA504F48
SHA256:58EE4041964BC96FFE6316DF7A08141748A5279C458C32F11424C74B93A85A23
2696AutoHotkey_1.1.32.00_setup.exeC:\Users\admin\AppData\Local\Temp\7z6FE8AA88\Compiler\ANSI 32-bit.binexecutable
MD5:50D8D5F7AED3F352C47FC7DDC680ED5F
SHA256:6F61639F4ADD3CE0943CAF3B2BE3FFB8F76B5612869FF51CAAF71BEDC2DBFFD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3328
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3328
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3436
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3436
iexplore.exe
104.18.45.93:443
www.autohotkey.com
Cloudflare Inc
US
unknown
3328
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3328
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3328
iexplore.exe
72.21.81.200:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.autohotkey.com
  • 104.18.45.93
  • 104.18.44.93
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 72.21.81.200
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.autohotkey.com/download/ahk-install.exe