Overview
overview
3Static
static
1Autoruns.exe
windows10-2004-x64
3Autoruns.exe
windows11-21h2-x64
3Autoruns64.exe
windows10-2004-x64
3Autoruns64.exe
windows11-21h2-x64
3Autoruns64a.exe
windows10-2004-x64
Autoruns64a.exe
windows11-21h2-x64
autoruns.chm
windows10-2004-x64
1autoruns.chm
windows11-21h2-x64
1autorunsc.exe
windows10-2004-x64
3autorunsc.exe
windows11-21h2-x64
3autorunsc64.exe
windows10-2004-x64
3autorunsc64.exe
windows11-21h2-x64
3autorunsc64a.exe
windows10-2004-x64
autorunsc64a.exe
windows11-21h2-x64
Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
Autoruns.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Autoruns.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
Autoruns64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Autoruns64.exe
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Autoruns64a.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Autoruns64a.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
autoruns.chm
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
autoruns.chm
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
autorunsc.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
autorunsc.exe
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
autorunsc64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
autorunsc64.exe
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
autorunsc64a.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
autorunsc64a.exe
Resource
win11-20260513-en
General
- Target autorunsc64.exe
- Size 794KB
- Sample260602-phtffsc16s
- SHA256 feb3969365d85e01cfa9147c5c3046ba6da35e1b356da6481122aec99d77cb10
- MD5 5b100e0e08d529747cca346abe0a0063
- SHA1 bcdf2587f6a9f4187ca705fac0bbf56c1191adcb
- SHA512 2979510270771090556fc8c1cfd5e35d2f4194cfd0e2cc348d6d15e4bd14141837834da31910e23a73d1862e3b004d83be87a12915ce97ae40d4de04e84819bc
- SSDEEP 12288:pycZXoguGXSn4t1CjhDmh4m5snalIGa1bESe9qZs8cwdf:py6Xo8XSnqcEz5saq1dZdf
- TLSH T17F057D2567F803A4F1BAC6748A274912F9717C571B75AA8F039049AE1F33E98DD3C722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2592 autorunsc64.exe 2592 autorunsc64.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2592 autorunsc64.exe Token: SeImpersonatePrivilege 2592 autorunsc64.exe Token: SeSecurityPrivilege 2592 autorunsc64.exe Token: SeDebugPrivilege 2592 autorunsc64.exe Token: SeBackupPrivilege 2592 autorunsc64.exe Token: SeRestorePrivilege 2592 autorunsc64.exe