Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 02:37

General

  • Target

    AutoGpuAffinity/AutoGpuAffinity/AutoGpuAffinity.exe

  • Size

    9.5MB

  • MD5

    7ff1b350471b74b4d1761346ced3bf4e

  • SHA1

    f22183fe77d1718350262f70d324c5c6e3872ae0

  • SHA256

    b15e43031731b76a403b2a3caf193fd1ad4fafe77b1e550b473a1f4d4839b29d

  • SHA512

    00304d72dd0ba76c8b11d93e847e69267371bb6b40e082fec91590dbd258427a89272507d64f38883b1248972f5c2ea3f875932582f62ecc8b020ede0164add0

  • SSDEEP

    196608:1sz0sKYu/PaQVBlibbtc19onJ5hrZERkB2WZufOuD9LjjNWKKy1IrpDhm:qQVBl8btc19c5hlERA2WmfDZ3URoUd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 29 IoCs
  • Drops file in Windows directory 3 IoCs
  • Kills process with taskkill 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\AutoGpuAffinity.exe
    "C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\AutoGpuAffinity.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\AutoGpuAffinity.exe
      "C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\AutoGpuAffinity.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM xperf.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2140
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM lava-triangle.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM PresentMon-1.6.0-x64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\bin\restart64\restart64.exe
        C:\Users\Admin\AppData\Local\Temp\AutoGpuAffinity\AutoGpuAffinity\bin\restart64\restart64.exe /q
        3⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\VCRUNTIME140.dll

    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\VCRUNTIME140_1.dll

    Filesize

    43KB

    MD5

    21ae0d0cfe9ab13f266ad7cd683296be

    SHA1

    f13878738f2932c56e07aa3c6325e4e19d64ae9f

    SHA256

    7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

    SHA512

    6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\_bz2.pyd

    Filesize

    84KB

    MD5

    b89b6c064cd8241ae12addb7f376cab2

    SHA1

    29e86a1df404c442e14344042d39a98dd15425f7

    SHA256

    0563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb

    SHA512

    f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\_lzma.pyd

    Filesize

    158KB

    MD5

    6e396653552d446c8114e98e5e195d09

    SHA1

    c1f760617f7f640d6f84074d6d5218d5a338a6ec

    SHA256

    5ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf

    SHA512

    c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-file-l1-2-0.dll

    Filesize

    20KB

    MD5

    d92e6a007fc22a1e218552ebfb65da93

    SHA1

    3c9909332e94f7b7386664a90f52730f4027a75a

    SHA256

    03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

    SHA512

    b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-file-l2-1-0.dll

    Filesize

    20KB

    MD5

    50abf0a7ee67f00f247bada185a7661c

    SHA1

    0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

    SHA256

    f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

    SHA512

    c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    de5695f26a0bcb54f59a8bc3f9a4ecef

    SHA1

    99c32595f3edc2c58bdb138c3384194831e901d6

    SHA256

    e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

    SHA512

    df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    20KB

    MD5

    74c264cffc09d183fcb1555b16ea7e4b

    SHA1

    0b5b08cdf6e749b48254ac811ca09ba95473d47c

    SHA256

    a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

    SHA512

    285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    20KB

    MD5

    cb39eea2ef9ed3674c597d5f0667b5b4

    SHA1

    c133dc6416b3346fa5b0f449d7cc6f7dbf580432

    SHA256

    1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

    SHA512

    2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    20KB

    MD5

    a68d15cab300774d2a20a986ee57f9f4

    SHA1

    bb69665b3c8714d935ee63791181491b819795cb

    SHA256

    966ddbf59e1d6c2a80b8abbf4a30d37475de097bf13fb72ba78684d65975cd97

    SHA512

    ac040f92560631ca5162c7559173bdfe858e282225967ab1adc0a038d34943b00db140d44319cd2cdc2864295a098ab0ba634dfaa443e1d1782fa143ae4c217d

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    24KB

    MD5

    0e35e369165875d3a593d68324e2b162

    SHA1

    6a1ff3405277250a892b79faed01dcdc9dbf864a

    SHA256

    14694879f9c3c52fbd7dde96bf5d67b9768b067c80d5567be55b37262e9dbd54

    SHA512

    d496f0c38300d0eed62b26a59c57463a1444a0c77a75c463014c5791371deca93d1d5dd0090e8e324c6a09bd9cff328f94947272ca49018c191c12732e805ee8

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    20KB

    MD5

    dacf383a06480ca5ab70d7156aecab43

    SHA1

    9e48d096c2e81a7d979f3c6b94315671157206a1

    SHA256

    00f84c438aab40500a2f2df22c7a4ec147a50509c8d0cdac6a83e4269e387478

    SHA512

    5d4146a669ddb963cf677257ec7865e2cfcb7960e41a38bbd60f9a7017474ed2f3291505fa407e25881cbf9e5e6b8055ff3bd891043284a0a04e3fe9cfad9817

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    d725d87a331e3073bf289d4ec85bd04d

    SHA1

    c9d36103be794a802957d0a8243b066fa22f2e43

    SHA256

    30bcf934cbcc9ed72ff364b6e352a70a9e2afa46eceadea5c47183cb46cfd16e

    SHA512

    6713ff954221c5dd835c15556e5fa6b8684fa7e19ce4f527a5892e77f322b3dae7199a232040b89ad4a9575c8d9788d771892d2294f3c18da45e643eb25fdb08

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    20KB

    MD5

    9151e83b4fdfa88353b7a97ae7792678

    SHA1

    b46152e70d5d3d75d61d4ccdb50403bd08bb9354

    SHA256

    6c0e0d22b65329f4948fcf36c8048a54ccccbf6c05b330b2c1a686f3e686eed0

    SHA512

    4d4210474957e656d821e1dc5934a4bfbf7e73dd61d696a1ab39914f887810c8fbe500dbb1e23782b40807f25820f35c9665e04dcdc2fd0f6c83046a4aecb86b

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    20KB

    MD5

    ebc168d7d3ea7c6192935359b6327627

    SHA1

    aeceb7c071cf1bb000758b6ceebefeec91ad22bd

    SHA256

    c048a3d7ab951dce1d6d3f5f497b50353f640a1787c6c65677a13c55c8e99983

    SHA512

    891d252ecd50bded4614547758d5e301bdf8e71fbb1023ff89f8de2f81927cc7cc84b98985d99e8fa8dcbf361e5117d9c625dc0d36983afc3f2aa48a54ce3d48

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    28KB

    MD5

    7a235962dbab1e807c6ec7609fc76077

    SHA1

    148ddd11a0d366313f75871007057b3f0485ab33

    SHA256

    f7c5d7394643c95fe14c07773a8a206e74a28db125f9b3976f9e1c8c599f2af1

    SHA512

    25b21ee7bb333e5e34d2b4a32d631a50b8ffaf1f1320d47c97c2a4dff59fa2a2703cdf30638b46c800d3150efaa4a2518c55e7b2a3b2e4273f43dd5ca83ae940

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    20KB

    MD5

    55463244172161b76546dc2de37f42bd

    SHA1

    c10a5360ad5e340d59c814e159ea1efcbf5bf3ee

    SHA256

    4166a32551989f960dac7c0e296ffb28092f45f6539e7c450fa04bf17612be73

    SHA512

    eacec78ff95f60def6f7f27bda4a84f1dd2dfa386efc4f6da770c37268df83c5b402693ea5c29f54d48026579f3843db26add4d6448ea10cbf7f14d4d14a72fd

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    24KB

    MD5

    27c4a3bcc0f1dba2de4c2242cd489f3b

    SHA1

    a704fd91e3c67108b1f02fd5e9f1223c7154a9cc

    SHA256

    315ded39d9e157cec05d83711c09858c23602857c9d8c88beef121c24c43be84

    SHA512

    793e74dfb1052c06ab4c29e7b622c795cc3122a722382b103940b94e9dac1e6ca8039df48c558efcc5d952a0660393ae2b11ced5ade4dc8d5dd31a9f5bb9f807

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    306608a878089cb38602af693ba0485b

    SHA1

    59753556f471c5bf1dfef46806cb02cf87590c5c

    SHA256

    3b59a50457f6b6eaa6d35e42722d4562e88bcd716bae113be1271ead0feb7af3

    SHA512

    21b626e619aaf4eda861a9c5edf02133c63adc9e893f38fede72d90a6e8be0e566c117a8a24ca4bab77928083ae4a859034417b035e8553cc7ccfb88cb4cbd9c

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    ec1381c9fda84228441459151e7badea

    SHA1

    db2d37f3c04a2c2d4b6f9b3fd82c1be091e85d2c

    SHA256

    44ddab31c182235ac5405d31c1cba048316cc230698e392a732ac941ec683bad

    SHA512

    ee9ebbdc23e7c945f2b291fde5eb68a42c11988182e6c78c0ab8fa9cb003b24910974a3291bcdaa0c8d1f9dfa8df40293848fb9a16c4be1425253bed0511a712

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    20KB

    MD5

    4cf70855444f38e1eb71f9c3cd1c6e86

    SHA1

    d06aec4008d397756ee841f0e7a435d1c05b5f07

    SHA256

    a409e25a9d3c252cc0a5af9df85d3733e946087b06cd1fb2cf1bf640eb0d49ba

    SHA512

    a13a80645e679343ac5638e8aa6a03012f16200cb3a4637be52a01aa3bef854324a8ed1882ca91b304b9c47b6351b1fc1671f4dede5be77bc208a71fe6029064

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    20KB

    MD5

    fcd6b29932d6fb307964b2d3f94e6b48

    SHA1

    be560f8a63c8e36a7b3fa48ff384f99f69a5d4f7

    SHA256

    cfb2ee4e426bb00b76163c1a66cf8cfef8d7450cbf9bbce3bc9eb2053f51e0e5

    SHA512

    3edfcf559f1e21870277358e6d266a1a0cea68b163b11c73108f3b6a56006d20b51410a3b4ea39bf80906bf6c9d573e1072697cfcd6a3d37e3679ea54757c69f

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\base_library.zip

    Filesize

    1006KB

    MD5

    b8ed5687a2c94bdc9f296397960a5ba5

    SHA1

    5df50ccbf84ad3d3e39c9a0268d8ac70a191d919

    SHA256

    8e842e19cc3584af7009f414189b0f103a34c5f21477ba953869a5abf50e2624

    SHA512

    f61a8e30ca783fa07ad8bf8fcbe8bf600e674edae9fc870ed4953d43f4b9a8843a1eb081269e98bcc2441b4c9324c531c29e6857a32425c4baf7280fc28a29a8

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\python38.dll

    Filesize

    4.0MB

    MD5

    3cd1e87aeb3d0037d52c8e51030e1084

    SHA1

    49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af

    SHA256

    13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8

    SHA512

    497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\pywin32_system32\pythoncom38.dll

    Filesize

    691KB

    MD5

    597955a07be4ae08f3b09adbf996fa83

    SHA1

    3817e541646fd3cdd7a8256a1260f6edfe7dd0c0

    SHA256

    ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7

    SHA512

    485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\pywin32_system32\pywintypes38.dll

    Filesize

    139KB

    MD5

    f60da44a33910eda70d838d7635d8fb1

    SHA1

    c35b4cf47349888384729386c74c374edb6f6ff3

    SHA256

    13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

    SHA512

    3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    3b337c2d41069b0a1e43e30f891c3813

    SHA1

    ebee2827b5cb153cbbb51c9718da1549fa80fc5c

    SHA256

    c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

    SHA512

    fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

  • C:\Users\Admin\AppData\Local\Temp\_MEI22962\win32\win32api.pyd

    Filesize

    138KB

    MD5

    57be78d0f2a66700600266ebc86c9b3c

    SHA1

    a47987d476cb9c76698890405e0b65aa10e07169

    SHA256

    9ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2

    SHA512

    98c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c

  • \Users\Admin\AppData\Local\Temp\_MEI22962\_ctypes.pyd

    Filesize

    123KB

    MD5

    4d13a7b3ecc8c7dc96a0424c465d7251

    SHA1

    0c72f7259ac9108d956aede40b6fcdf3a3943cb5

    SHA256

    2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed

    SHA512

    68ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8