Autoruns[.]exe | Triage™

Resubmissions

01/10/2026, 08:42

261001-kl567szekh

01/10/2026, 08:37

261001-kh6csszcja3

Sharing

Copy URL Twitter E-mail

General

Target
Autoruns.exe
Size 1.7MB
Sample261001-kh6csszcja
SHA256 38519c3ae945f678261327d05efe8fb0be44afb91236bd71199e20e1151ff157
MD5 71f811047b7a455117a8fdd0e136ccfc
SHA1 0beb22b80aa17e98fba6bba3a311027abb8d596e
SHA512 6ab50b977f3b7f2186ba4d09a0e5f2cfb2c5aba6e8ae5ac8d6048b6ca3d5afb01bb50082738413ed42032c27424b9194c729e12075154d45c59389bdae77addd
SSDEEP 12288:p5qBgjF5+zKTt1Biwh2aTy410I0qTSiY8Td/fV3NawuWWrfZetCvmK4nj7UIW/h:p5Tt1BiC2a+DqT9TlfHuW+MnMIW/h
TLSH
T1028539E321D98416C86E06B01164877E46EF6C3E4BE388CB92DBBD2D67345CD2B32657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Autoruns.exe

.exe 1.7MB

Autoruns.exe

IMPHASH 2418ca697ff3a1e12dac4a0b4a01b85e
SHA256 38519c3ae945f678261327d05efe8fb0be44afb91236bd71199e20e1151ff157
MD5 71f811047b7a455117a8fdd0e136ccfc
SHA1 0beb22b80aa17e98fba6bba3a311027abb8d596e
SHA512 6ab50b977f3b7f2186ba4d09a0e5f2cfb2c5aba6e8ae5ac8d6048b6ca3d5afb01bb50082738413ed42032c27424b9194c729e12075154d45c59389bdae77addd
SSDEEP 12288:p5qBgjF5+zKTt1Biwh2aTy410I0qTSiY8Td/fV3NawuWWrfZetCvmK4nj7UIW/h:p5Tt1BiC2a+DqT9TlfHuW+MnMIW/h
TLSH
T1028539E321D98416C86E06B01164877E46EF6C3E4BE388CB92DBBD2D67345CD2B32657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

2e:68:e8:f0:c8:28:e8:c8:a6:c2:e0:4e:67:90:4a:79:c5:39:d7:e6:ad:6f:f8:79:82:02:69:8b:24:40:e3:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 17, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:22:41:d2:f6:aa:ff:c8:b5:ff:00:01:00:00:02:22

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

536272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\__w\1\s\Win32\Release\Autoruns.pdb

kernel32

ReadConsoleInputW SetConsoleMode GetConsoleMode GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetConsoleCP ExitProcess VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable GetCPInfo GetSystemTimeAsFileTime FlushFileBuffers QueryPerformanceCounter LCMapStringEx InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent FindPackagesByPackageFamily GetNativeSystemInfo IsWow64Process GetFileTime QueryDosDeviceW GetLogicalDrives SearchPathW K32GetMappedFileNameW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize FileTimeToLocalFileTime CreateThreadpoolTimer CloseThreadpoolTimer SetThreadpoolTimer TrySubmitThreadpoolCallback WaitForMultipleObjects CreateSemaphoreW CreateEventW SetEnvironmentVariableW FindClose FindNextFileW FindFirstFileW ReleaseSemaphore SetEvent GetWindowsDirectoryW GetSystemWow64DirectoryW GetSystemWindowsDirectoryW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW GetFileType LocalAlloc GetStdHandle GetVersionExW GetTickCount64 WaitForSingleObject GetSystemDirectoryW CreateThread TerminateThread Sleep OpenProcess ExpandEnvironmentStringsW CreateProcessW GetStartupInfoW GetCommandLineW GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW VirtualQuery GetFullPathNameW GetComputerNameW LocalFree lstrcmpW SetFileAttributesW CreateDirectoryW RemoveDirectoryW MoveFileW GetTimeFormatW GetDateFormatW GetNumberFormatEx GetLocaleInfoW Wow64RevertWow64FsRedirection GetFileInformationByHandle Wow64DisableWow64FsRedirection FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetCurrentThread SetThreadPriority GlobalAlloc DecodePointer SetCurrentDirectoryW LoadLibraryExW MultiByteToWideChar lstrcmpiW WideCharToMultiByte GetModuleHandleExW lstrlenW DeleteFileW CloseHandle WriteFile CreateFileW GetTempFileNameW GetTempPathW GetThreadId FreeLibrary LoadLibraryW MulDiv GetModuleFileNameW RaiseException GetCurrentThreadId SetLastError LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx GetLastError DeleteCriticalSection GetPrivateProfileIntW GetPrivateProfileStringW GetFileAttributesW GetCurrentProcess GetModuleHandleW GetProcAddress FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GlobalUnlock GlobalLock

user32

SetClipboardData CloseClipboard EmptyClipboard IsRectEmpty SendMessageW OpenClipboard SetForegroundWindow WaitForInputIdle FindWindowW EnumDisplaySettingsW IsDlgButtonChecked CheckDlgButton GetDlgItemTextW EnableWindow CreatePopupMenu RemoveMenu AdjustWindowRectEx SetRect SetRectEmpty SetCursorPos MessageBeep CharLowerW GetWindowThreadProcessId GetMessagePos WindowFromPoint GetDesktopWindow GetCursorPos GetSysColor DrawIconEx SetMenuItemInfoW DestroyMenu DialogBoxIndirectParamW FindWindowExW LoadImageW SetWindowTextW GetWindowTextW GetWindowTextLengthW InvalidateRect KillTimer GetWindowLongW GetParent SetTimer SetFocus GetFocus BeginPaint EndPaint GetClientRect DrawTextW SetWindowLongW DefWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW InsertMenuW TranslateAcceleratorW IsMenu RegisterWindowMessageW SetCapture ClientToScreen TrackMouseEvent GetCapture GetDlgCtrlID ReleaseCapture GetKeyState CreateDialogParamW PostQuitMessage LoadStringA DialogBoxParamW SetWindowPlacement SetCursor MessageBoxW GetActiveWindow GetWindowPlacement SetMenu GetMenu IsDialogMessageW EnableMenuItem CheckMenuRadioItem SetMenuDefaultItem AppendMenuW GetMenuItemID DeleteMenu DrawEdge DrawFrameControl SetMenuInfo GetMenuInfo GetSubMenu ModifyMenuW GetMenuItemInfoW GetMenuItemCount MonitorFromPoint TrackPopupMenuEx EnumChildWindows LoadAcceleratorsW LoadMenuW LoadStringW DestroyWindow GetMessageW TranslateMessage DispatchMessageW CharNextW IsWindow PeekMessageW LoadIconW GetDlgItem EndDialog SetDlgItemTextW GetWindow GetWindowRect MapWindowPoints SetScrollInfo UnhookWindowsHookEx GetAncestor GetWindowModuleFileNameW IsChild CallNextHookEx SetWindowsHookExW GetClassNameW SetClassLongW SystemParametersInfoW DestroyIcon IsZoomed ScreenToClient GetMonitorInfoW MonitorFromWindow GetWindowDC RedrawWindow PtInRect PostMessageW ShowScrollBar IsWindowVisible UpdateWindow ReleaseDC GetDC OffsetRect FillRect SetWindowPos GetSystemMetrics MoveWindow SetScrollPos ShowWindow GetScrollInfo DrawFocusRect IsWindowEnabled FrameRect CopyRect InflateRect GetSysColorBrush CallWindowProcW CreateWindowExW LoadCursorW

gdi32

SetViewportOrgEx SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject DeleteDC BitBlt SetBkColor ExtTextOutW SetTextColor SetBkMode GetObjectW CreateFontIndirectW CreateSolidBrush GetStockObject GetDeviceCaps MoveToEx LineTo GetTextExtentPoint32W Rectangle SetTextAlign Polyline CreatePatternBrush CreateBitmap SetBrushOrgEx PatBlt CreateDIBSection ExcludeClipRect Polygon GetCurrentObject EndPage StartDocW SetMapMode EndDoc StartPage CreatePen TextOutW

comdlg32

PrintDlgW ChooseFontW GetSaveFileNameW FindTextW GetOpenFileNameW

advapi32

RegCreateKeyW RegOpenKeyW RegRenameKey RegEnumValueW CloseServiceHandle DeleteService ControlService QueryServiceStatus OpenServiceW OpenSCManagerW ConvertStringSidToSidW LookupAccountSidW RegDeleteTreeW RegCopyTreeW RegQueryValueExW RegLoadKeyW OpenProcessToken GetTokenInformation IsValidSid GetLengthSid ConvertSidToStringSidW CopySid RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptDestroyHash GetServiceDisplayNameW QueryServiceConfig2W AdjustTokenPrivileges LookupPrivilegeValueW RegLoadMUIStringW CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW CryptReleaseContext

shell32

SHGetKnownFolderPath SHEvaluateSystemCommandTemplate ExtractIconExW ShellExecuteW ExtractAssociatedIconW CommandLineToArgvW ShellExecuteExW SHGetStockIconInfo

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoInitializeEx StgCreateStorageEx StgOpenStorageEx StringFromGUID2

oleaut32

SysStringLen SysAllocString SysFreeString VarUI4FromStr VariantInit VariantClear

shlwapi

SHAutoComplete SHCreateStreamOnFileW ord487

comctl32

CreateStatusWindowW ImageList_EndDrag ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_DragEnter ImageList_Duplicate ImageList_Draw ImageList_Read ImageList_WriteEx ord344 ImageList_GetIcon ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx ImageList_AddMasked ImageList_Destroy ImageList_DrawEx ImageList_GetIconSize ImageList_BeginDrag ImageList_GetImageCount ImageList_DrawIndirect

uxtheme

IsAppThemed IsThemeActive SetWindowTheme

msimg32

GradientFill

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

dwmapi

DwmSetWindowAttribute DwmDefWindowProc

winhttp

WinHttpConnect WinHttpOpen WinHttpWriteData WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpSetOption WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest

crypt32

CertGetNameStringW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Autoruns.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

uxtheme

msimg32

version

dwmapi

winhttp

crypt32

generic