| File name: | AutoHotkey_2.0.19_setup.exe |
| Full analysis: | https://app.any.run/tasks/1a488897-e3e6-47dc-b850-8c621454e5a1 |
| Verdict: | Malicious activity |
| Analysis date: | January 30, 2025, 12:54:54 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections |
| MD5: | 34979CF8AB65E09D738FD6B95365CEFB |
| SHA1: | 0AFD36786EEB45BBE7DB1CF2A6D2251C10DA303C |
| SHA256: | FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A |
| SSDEEP: | 98304:/Rv3DwxUAtz2eVhxkk/7wIvycwI0mm/H7Krd6dV9zXv8E2d4J1KD3B+yfaXDFcd2:WmxZCp |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Executable content was dropped or overwritten
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Application launched itself
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkeyUX.exe (PID: 6348)
Creates a software uninstall entry
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Adds/modifies Windows certificates
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
AUTOHOTKEY mutex has been found
- AutoHotkeyUX.exe (PID: 2928)
INFO
The sample compiled with english language support
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Creates files in the program directory
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Reads the computer name
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkeyUX.exe (PID: 6348)
- AutoHotkeyUX.exe (PID: 2928)
Checks supported languages
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
- AutoHotkeyUX.exe (PID: 6324)
- AutoHotkeyUX.exe (PID: 6348)
Reads the machine GUID from the registry
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Creates files or folders in the user directory
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
Process checks computer location settings
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
AutoHotkey executable
- AutoHotkey_2.0.19_setup.exe (PID: 4864)
- AutoHotkey_2.0.19_setup.exe (PID: 7076)
- AutoHotkeyUX.exe (PID: 6348)
Manual execution by a user
- AutoHotkeyUX.exe (PID: 6348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (64.2) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.6) |
| .exe | | | Win32 Executable (generic) (10.6) |
| .exe | | | Generic Win/DOS Executable (4.7) |
| .exe | | | DOS Executable Generic (4.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:01:25 08:00:28+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.39 |
| CodeSize: | 2994176 |
| InitializedDataSize: | 40960 |
| UninitializedDataSize: | 2527232 |
| EntryPoint: | 0x544000 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.0.19.0 |
| ProductVersionNumber: | 2.0.19.0 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| FileDescription: | AutoHotkey installer |
| FileVersion: | 2.0.19 |
| ProductName: | AutoHotkey Setup |
| ProductVersion: | 2.0.19 |
| InternalName: | AutoHotkey Setup |
Total processes
134
Monitored processes
5
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2928 | "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" /script WindowSpy.ahk | C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe | AutoHotkeyUX.exe | ||||||||||||
User: admin Company: AutoHotkey Foundation LLC Integrity Level: MEDIUM Description: AutoHotkey 64-bit Exit code: 0 Version: 2.0.19 Modules
| |||||||||||||||
| 4864 | "C:\Users\admin\Downloads\AutoHotkey_2.0.19_setup.exe" | C:\Users\admin\Downloads\AutoHotkey_2.0.19_setup.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: AutoHotkey installer Exit code: 0 Version: 2.0.19 Modules
| |||||||||||||||
| 6324 | "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check | C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe | — | AutoHotkey_2.0.19_setup.exe | |||||||||||
User: admin Company: AutoHotkey Foundation LLC Integrity Level: HIGH Description: AutoHotkey 64-bit Exit code: 0 Version: 2.0.19 Modules
| |||||||||||||||
| 6348 | "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk | C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe | — | explorer.exe | |||||||||||
User: admin Company: AutoHotkey Foundation LLC Integrity Level: MEDIUM Description: AutoHotkey 64-bit Version: 2.0.19 Modules
| |||||||||||||||
| 7076 | "C:\Users\admin\Downloads\AutoHotkey_2.0.19_setup.exe" /to "C:\Program Files\AutoHotkey" | C:\Users\admin\Downloads\AutoHotkey_2.0.19_setup.exe | AutoHotkey_2.0.19_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: AutoHotkey installer Exit code: 0 Version: 2.0.19 Modules
| |||||||||||||||
Total events
7 509
Read events
7 475
Write events
27
Delete events
7
Modification events
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | DisplayName |
Value: AutoHotkey | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk" | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\install.ahk" /uninstall /silent | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | DisplayVersion |
Value: 2.0.19 | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | URLInfoAbout |
Value: https://autohotkey.com | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | Publisher |
Value: AutoHotkey Foundation LLC | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\AutoHotkey | |||
| (PID) Process: | (7076) AutoHotkey_2.0.19_setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey |
| Operation: | write | Name: | InstallDir |
Value: C:\Program Files\AutoHotkey | |||
Executable files
11
Suspicious files
5
Text files
64
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\AutoHotkey32.exe | executable | |
MD5:564C4E3D2BF76B70A41596FEE7C209EB | SHA256:E0464215B4D096FA0B27CD34D5E6B15DD6EA7F71A9BCE837938A23FD7C8BEB36 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\install-version.ahk | text | |
MD5:30B87FBFADC592C38BE9D82EDF597FA3 | SHA256:1E59921BCDDB3C41651EB01605CDEFCDEE3C6ADEC5DB6B7CAFB7AB801EAD5E1E | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\Install.cmd | text | |
MD5:4CFB569D3628B7E14E729DE9956CC24B | SHA256:DB2578B4EE5617F45ACFFB3AF21E1D3FC31CDCF035DD9227C8061A950AA015E7 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-editor.ahk | text | |
MD5:82EB574294FF4E2E7461B95F5BAD0A87 | SHA256:7263286EB3A42ECCF5EDC39B43C74A8BF7C82F2671204D1AE654236C1DE3F05D | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\WindowSpy.ahk | text | |
MD5:1B081984B7C90528E03E67096F001E5F | SHA256:83E60BA7D330D4FAA32576C0AB223A2440EF92972D3D32DEE46D117E8A446CE9 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\reload-v1.ahk | text | |
MD5:35F4753A58432446B99BF89A9E930BF5 | SHA256:E4659306A755B583E9CEF5FDBA3B3EB102D8939FB028AFD91AAD4496E758FAD5 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\AutoHotkey.chm | binary | |
MD5:57BB054E56EB6FA154F5BCA6AFFA656A | SHA256:33D035BBC23CE61FA83E13DA126D17D3EB48ED210CA59E4F4BAB46F1BE3654C7 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\WindowSpy.ahk | text | |
MD5:E2067D978526B83A1DA967F16A69C125 | SHA256:040404A4DEF02F17CDAFDA938F5B63FC2181940BA1290DA5742DB0862C07166E | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-uninstall.ahk | text | |
MD5:0FE4932669E99A498A7BC76975919000 | SHA256:1E09FC4AF5DC3E673D4FACFE4FA849C6BDD0B29C67B0EFD7F96AAF387FCEF698 | |||
| 7076 | AutoHotkey_2.0.19_setup.exe | C:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-newscript.ahk | text | |
MD5:1B88198B4BD36EB25E23DC412321A555 | SHA256:31249EF15CCE83D150A9A5DE11168A5052FF2C55DBD574B8DF1C054510B61843 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5588 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5588 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6224 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 2.21.65.153:443 | www.bing.com | Akamai International B.V. | NL | whitelisted |
1176 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
5064 | SearchApp.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1076 | svchost.exe | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |