BR.exe launches an AutoIt script, clarifying the package’s role
A sandbox process tree shows BR.exe dropping Waters.a3x and launching it through AutoIt, despite the executable’s Internet Explorer product metadata. Two reports also record POST requests to the same IP address, but neither identifies the sending process or reveals the request body.
A process named BR.exe launched AutoIt3.exe with Waters.a3x as its argument. That parent-child relationship, recorded in a CAPE sandbox report, answers a question the executable’s “Internet Explorer” product metadata cannot: what was this package actually running? The evidence reviewed by CTX Threat Intelligence identifies a wrapper-and-script execution mechanism.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read