Suspicious 80% Download

Worm.Win32.AutoRun.qtm

Worm with process injection

Process analysis tool detectionCreateRemoteThread API string
SHA-25658e7fc5c8fcbcfd3c1c33b06b3f8774528230a93d1bb1c86302dfca4a05f9213
MaleculeO(Al)H(Po₂)

Evidence

Autoruns (Sysinternals) 0x43fc–0x451c
⋯5 more rows
0x444c2e65786500000000ffffffff0c000000.exe............
0x445c6175746f72756e732e65786500000000autoruns.exe....
0x446cffffffff0c0000006176677273737663........avgrssvc
0x447c2e65786500000000ffffffff0d000000.exe............
0x448c41764d6f6e69746f722e657865000000AvMonitor.exe...
0x449cffffffff0b0000004343656e7465722e........CCenter.
0x44ac65786500ffffffff0c00000063635376exe.........ccSv
0x44bc634873742e65786500000000ffffffffcHst.exe........
⋯6 more rows
CreateRemoteThread API string 0x12a4a–0x12b1a
⋯3 more rows
0x12a7a746550726f636573734d656d6f727900teProcessMemory.
0x12a8a43726561746552656d6f746554687265CreateRemoteThre
0x12a9a61640047657443757272656e74546872ad.GetCurrentThr
0x12aaa65616449640043726561746554687265eadId.CreateThre
⋯7 more rows
Execute shell command (ShellExecuteA) 0x14298–0x14358
⋯3 more rows
0x142c8938d124000c785b4fcffff24020000ff...@.......$....
0x142d8b5e0feffff6a08ff93c91240008985b0.....j.....@....
0x142e8fcffff8d85b4fcffff50ffb5b0fcffff.........P......
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.