| File name: | AutoHotkey_1.1.37.02_setup.exe |
| Full analysis: | https://app.any.run/tasks/0ababe5e-82b9-490d-904f-90c12e1cc98b |
| Verdict: | Malicious activity |
| Analysis date: | April 08, 2024, 14:55:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C2E8062052BB2B25D4951B78BA9A5E73 |
| SHA1: | 947DBF6343D632FC622CC2920D0AD303C32FCC80 |
| SHA256: | 49A48E879F7480238D2FE17520AC19AFE83685AAC0B886719F9E1EAC818B75CC |
| SSDEEP: | 98304:qruJDQ7RokGnq/yHXrgVQHFUCacKc/Gn9CtJFek03iMzwsIWdMw9jglAUuna6Syo:PDPM49zQi |
MALICIOUS
Drops the executable file immediately after the start
- AutoHotkey_1.1.37.02_setup.exe (PID: 4044)
- setup.exe (PID: 2892)
SUSPICIOUS
Executable content was dropped or overwritten
- AutoHotkey_1.1.37.02_setup.exe (PID: 4044)
- setup.exe (PID: 2892)
Reads the Internet Settings
- setup.exe (PID: 2892)
- hh.exe (PID: 2000)
Reads security settings of Internet Explorer
- setup.exe (PID: 2892)
Reads Microsoft Outlook installation path
- setup.exe (PID: 2892)
- hh.exe (PID: 2000)
Reads Internet Explorer settings
- setup.exe (PID: 2892)
- hh.exe (PID: 2000)
Creates a software uninstall entry
- setup.exe (PID: 2892)
Application launched itself
- AutoHotkey.exe (PID: 3508)
INFO
Checks supported languages
- AutoHotkey_1.1.37.02_setup.exe (PID: 4044)
- setup.exe (PID: 2892)
- AutoHotkey.exe (PID: 3508)
- AutoHotkey.exe (PID: 3068)
Reads the computer name
- setup.exe (PID: 2892)
- AutoHotkey.exe (PID: 3508)
Process checks whether UAC notifications are on
- setup.exe (PID: 2892)
- AutoHotkey.exe (PID: 3508)
Create files in a temporary directory
- AutoHotkey_1.1.37.02_setup.exe (PID: 4044)
- hh.exe (PID: 2000)
Checks proxy server information
- setup.exe (PID: 2892)
- hh.exe (PID: 2000)
Reads the machine GUID from the registry
- setup.exe (PID: 2892)
- hh.exe (PID: 2000)
Creates files in the program directory
- setup.exe (PID: 2892)
Manual execution by a user
- AutoHotkey.exe (PID: 3508)
Reads security settings of Internet Explorer
- hh.exe (PID: 2000)
Creates files or folders in the user directory
- hh.exe (PID: 2000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .dll | | | Win32 Dynamic Link Library (generic) (43.5) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (29.8) |
| .exe | | | Generic Win/DOS Executable (13.2) |
| .exe | | | DOS Executable Generic (13.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2010:11:18 18:41:55+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 22016 |
| InitializedDataSize: | 33792 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x643f |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.1.37.2 |
| ProductVersionNumber: | 1.1.37.2 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| FileDescription: | AutoHotkey Setup |
| FileVersion: | 1.1.37.02 |
| ProductName: | AutoHotkey |
| ProductVersion: | 1.1.37.02 |
Total processes
45
Monitored processes
6
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2000 | "hh.exe" "ms-its:AutoHotkey.chm::/docs/Welcome.htm" | C:\Windows\hh.exe | — | AutoHotkey.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® HTML Help Executable Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2892 | C:\Users\admin\AppData\Local\Temp\7z80610FCC\setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\setup.exe | AutoHotkey_1.1.37.02_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.1.37.02 Modules
| |||||||||||||||
| 3068 | AutoHotkey.exe | C:\Program Files\AutoHotkey\AutoHotkey.exe | — | AutoHotkey.exe | |||||||||||
User: admin Company: AutoHotkey Foundation LLC Integrity Level: MEDIUM Description: AutoHotkey Unicode 32-bit Exit code: 2 Version: 1.1.37.02 Modules
| |||||||||||||||
| 3500 | "C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe" | C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: AutoHotkey Setup Exit code: 3221226540 Version: 1.1.37.02 Modules
| |||||||||||||||
| 3508 | "C:\Program Files\AutoHotkey\AutoHotkey.exe" "C:\Program Files\AutoHotkey\Installer.ahk" /exec runahk | C:\Program Files\AutoHotkey\AutoHotkey.exe | — | explorer.exe | |||||||||||
User: admin Company: AutoHotkey Foundation LLC Integrity Level: MEDIUM Description: AutoHotkey Unicode 32-bit Exit code: 0 Version: 1.1.37.02 Modules
| |||||||||||||||
| 4044 | "C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe" | C:\Users\admin\AppData\Local\Temp\AutoHotkey_1.1.37.02_setup.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: AutoHotkey Setup Exit code: 0 Version: 1.1.37.02 Modules
| |||||||||||||||
Total events
4 307
Read events
4 272
Write events
35
Delete events
0
Modification events
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey |
| Operation: | write | Name: | InstallDir |
Value: C:\Program Files\AutoHotkey | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey |
| Operation: | write | Name: | Version |
Value: 1.1.37.02 | |||
| (PID) Process: | (2892) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey |
| Operation: | write | Name: | StartMenuFolder |
Value: AutoHotkey | |||
Executable files
17
Suspicious files
12
Text files
18
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\AutoHotkey.chm | binary | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\Compiler\ANSI 32-bit.bin | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\Compiler\Unicode 32-bit.bin | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\Compiler\Unicode 64-bit.bin | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\license.txt | text | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\Compiler\Ahk2Exe.exe | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\AutoHotkeyA32.exe | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\AutoHotkeyU32.exe | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\AutoHotkeyU64.exe | executable | |
MD5:— | SHA256:— | |||
| 4044 | AutoHotkey_1.1.37.02_setup.exe | C:\Users\admin\AppData\Local\Temp\7z80610FCC\setup.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |