Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 17:01
General
- Target Autocaptain-Setup-v0.2.0.exe
- Size 383KB
- Sample260807-vjshfahn5v
- SHA256 e495eb44d9c08f90f7a9c6075bd2c805842da9f8ee83cd2487537ae390d96e3d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autocaptain-Setup-v0.2.0.exe"C:\Users\Admin\AppData\Local\Temp\Autocaptain-Setup-v0.2.0.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.cmd" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install-Autocaptain.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Install-Autocaptain.ps1
Setup.cmd
memory/2912-31-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-32-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-27-0x00000213B55C0000-0x00000213B55E2000-memory.dmp
memory/2912-28-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-29-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-23-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-22-0x00007FF8A135F000-0x00007FF8A1360000-memory.dmp
memory/2912-25-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-33-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-34-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-35-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-36-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-37-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/2912-39-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp