e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/autopoweron.exe
Size

1.6MB
MD5

fc7a668a581fc7a511f54dbea3a2ab0a
SHA1

b5d783f2ef60a53b1168efcd42bb9bf4c4551fc5
SHA256

da4419f3cd770012d0a6be1f7f7330611dad237f156f446887cd6f11827769f9
SHA512

61c6384239324d06c89612eb364aef44b700f346f95eef8d6a07ef43a1ac39b60a73c842aaf5564a5a14480e3be3fc9d3c6ddb76c1dee4d3e5cf02c0f0491244
SSDEEP

49152:60f6wkRh2DvrwSNMzsl+1FqTe/yUpcNafcMYW4FG:gtGrwSegS4et0MYW4FG

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

autopoweron.exe

pid process

2916 autopoweron.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

autopoweron.exe

pid process

2916 autopoweron.exe

pid	process
2916	autopoweron.exe

pid	process
2916	autopoweron.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\autopoweron.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\autopoweron.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst168E.tmp\ioSpecial.ini

Filesize
633B

MD5
ce5ad38176646b57a2e989027117242c

SHA1
f161f61019183d91ece5d177fa174044b108f8af

SHA256
1298b458a7277003a7942ecd28c0e0900f93cb5b9995475672bcfd827e133c24

SHA512
6a940e69abd875b2119c75586c3d31d1f74ecb262d85880ca49b7518c087ab18ed5846829d822d3b38b6b6caa713205f2bdc9f984747cfc26869f7ecc291546d

Download Submit
\Users\Admin\AppData\Local\Temp\nst168E.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit