Overview
overview
10Static
static
10AutoPowerO...on.exe
windows7-x64
7AutoPowerO...on.exe
windows10-2004-x64
7$PLUGINSDI...on.exe
windows7-x64
7$PLUGINSDI...on.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3AutoPower.exe
windows7-x64
10AutoPower.exe
windows10-2004-x64
10Help.chm
windows7-x64
1Help.chm
windows10-2004-x64
1RunDLL.dll
windows7-x64
3RunDLL.dll
windows10-2004-x64
3SASHOOK.dll
windows7-x64
3SASHOOK.dll
windows10-2004-x64
3autoss.exe
windows7-x64
10autoss.exe
windows10-2004-x64
10disktop.exe
windows7-x64
1disktop.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7AutoPowerO...��.htm
windows7-x64
1AutoPowerO...��.htm
windows10-2004-x64
1AutoPowerO...�).url
windows7-x64
1AutoPowerO...�).url
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 20:31
Behavioral task
behavioral1
Sample
AutoPowerOn_windown8/AutoPowerOn/autopoweron.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
AutoPowerOn_windown8/AutoPowerOn/autopoweron.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/autopoweron.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/autopoweron.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
AutoPower.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
AutoPower.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Help.chm
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Help.chm
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
RunDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
RunDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
SASHOOK.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
SASHOOK.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
autoss.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
autoss.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
disktop.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
disktop.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
uninst.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
AutoPowerOn_windown8/下载说明.htm
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
AutoPowerOn_windown8/下载说明.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
AutoPowerOn_windown8/使用帮助(河东软件园).url
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
AutoPowerOn_windown8/使用帮助(河东软件园).url
Resource
win10v2004-20240508-en
General
-
Target
AutoPowerOn_windown8/AutoPowerOn/autopoweron.exe
-
Size
1.8MB
-
MD5
34c106898919bff9359ce5cf99bf6ade
-
SHA1
bb986ebef961ece36fccb89345a7139c67794c05
-
SHA256
43eed68aa81badf0946ddb6cd710fae2bca84c691124e0e1c1609189e56c3978
-
SHA512
c96998e2cee6ebb3c011b7355e6382e9dfeec5e7a773f49cdad39b8abae3610203c802cd81f80a08ad517494f4a4cbefe415ed229530206ce6672e622e7d0647
-
SSDEEP
49152:saKc0f6wkRh2DvrwSNMzsl+1FqTe/yUpcNafcMYW4FW:AitGrwSegS4et0MYW4FW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
autopoweron.exepid process 2296 autopoweron.exe -
Loads dropped DLL 5 IoCs
Processes:
autopoweron.exeautopoweron.exepid process 2300 autopoweron.exe 2296 autopoweron.exe 2296 autopoweron.exe 2296 autopoweron.exe 2296 autopoweron.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nstCCE.tmp\autopoweron.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\nstCCE.tmp\autopoweron.exe nsis_installer_2 -
Processes:
autopoweron.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\DisplayName = "°Ù¶È" autopoweron.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\URL = "http://www.baidu.com/s?wd={searchTerms}&tn=site888_1_pg&cl=3&ie=utf-8" autopoweron.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes autopoweron.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{24588FA4-10F1-41D7-B19D-6E22361E47FA}" autopoweron.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA} autopoweron.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\Codepage = "65001" autopoweron.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
autopoweron.exepid process 2296 autopoweron.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
autopoweron.exedescription pid process target process PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe PID 2300 wrote to memory of 2296 2300 autopoweron.exe autopoweron.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoPowerOn_windown8\AutoPowerOn\autopoweron.exe"C:\Users\Admin\AppData\Local\Temp\AutoPowerOn_windown8\AutoPowerOn\autopoweron.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nstCCE.tmp\autopoweron.exeC:\Users\Admin\AppData\Local\Temp\nstCCE.tmp\autopoweron.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsyD89.tmp\ioSpecial.iniFilesize
632B
MD5a99d5e1f24d4d202ada57f991d03ce19
SHA17ce6c26f109af5c626d6182d121d1adca3c37a6a
SHA2568025be383a7c624227896a2eee2ef727831837b7453168e3b974d5828a469771
SHA5127d18a0a0acbef69a9a93101701fdf2063075b94f8a2a2589edc57f2b9937b310c33db07011c6aa8816144e4af8cff885ccf5ab6f0bcb8427cefb0dcb85647a3e
-
\Users\Admin\AppData\Local\Temp\nstCCE.tmp\autopoweron.exeFilesize
1.6MB
MD5fc7a668a581fc7a511f54dbea3a2ab0a
SHA1b5d783f2ef60a53b1168efcd42bb9bf4c4551fc5
SHA256da4419f3cd770012d0a6be1f7f7330611dad237f156f446887cd6f11827769f9
SHA51261c6384239324d06c89612eb364aef44b700f346f95eef8d6a07ef43a1ac39b60a73c842aaf5564a5a14480e3be3fc9d3c6ddb76c1dee4d3e5cf02c0f0491244
-
\Users\Admin\AppData\Local\Temp\nsyD89.tmp\InstallOptions.dllFilesize
14KB
MD50dc0cc7a6d9db685bf05a7e5f3ea4781
SHA15d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA2568e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
SHA512814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0