Autoruns[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Autoruns.exe
Size 1.7MB
Sample261002-ntmava1w2j
SHA256 f41051697b220757f3612ecd00749b952ce7bcaadd9dc782d79ef0338e45c3b6
MD5 61506280fc7e663db6715ac2206af6d4
SHA1 3b42f1e497c909d48343768b58e9e5222d540330
SHA512 4343ace3777173fbf68c501d15011fec940f9f3eea7206712f9934bab432d15753b4c6c0369eb14b8341221992f964c5a37c23a655255572b1a13cde717b2472
SSDEEP 12288:g1hJ7jnpTutVfjKHhO5VwocPYOhV6y4wO9y+IpunYtALwBzKn2CXrfZetCvmK2UI:WcaHhMcPYq6+O+puYtAcBzg/7SmGNJ
TLSH
T1B1854AE322D9842AC87E4530012486BE07FB6D3E5BE349CB92C77E2957705CD5E32A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Autoruns.exe

.exe 1.7MB

Autoruns.exe

IMPHASH fc18756ef5e758178da800fd88864516
SHA256 f41051697b220757f3612ecd00749b952ce7bcaadd9dc782d79ef0338e45c3b6
MD5 61506280fc7e663db6715ac2206af6d4
SHA1 3b42f1e497c909d48343768b58e9e5222d540330
SHA512 4343ace3777173fbf68c501d15011fec940f9f3eea7206712f9934bab432d15753b4c6c0369eb14b8341221992f964c5a37c23a655255572b1a13cde717b2472
SSDEEP 12288:g1hJ7jnpTutVfjKHhO5VwocPYOhV6y4wO9y+IpunYtALwBzKn2CXrfZetCvmK2UI:WcaHhMcPYq6+O+puYtAcBzg/7SmGNJ
TLSH
T1B1854AE322D9842AC87E4530012486BE07FB6D3E5BE349CB92C77E2957705CD5E32A67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

99:fe:61:71:c4:fb:54:63:d4:79:62:5a:b9:4b:2c:00:46:a2:24:cf:b3:6c:c9:39:e9:d3:ba:c2:f4:1a:75:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 1, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

517725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\Win32\Release\Autoruns.pdb

kernel32

ReadConsoleInputW SetConsoleMode GetConsoleMode GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetConsoleCP ExitProcess VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable FlushFileBuffers QueryPerformanceCounter LCMapStringEx InitOnceBeginInitialize InitOnceComplete AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetFullPathNameW GetNativeSystemInfo IsWow64Process GetFileTime QueryDosDeviceW GetLogicalDrives SearchPathW K32GetMappedFileNameW WaitForMultipleObjects CreateSemaphoreW CreateEventW SetEnvironmentVariableW FindClose FindNextFileW FindFirstFileW ReleaseSemaphore SetEvent UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize FileTimeToLocalFileTime TrySubmitThreadpoolCallback CreateThreadpoolTimer CloseThreadpoolTimer SetThreadpoolTimer GetWindowsDirectoryW GetSystemWow64DirectoryW GetSystemWindowsDirectoryW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadFile WriteConsoleW LocalAlloc GetFileType GetStdHandle GetVersionExW GetTickCount64 GetSystemDirectoryW TerminateThread CreateThread WaitForSingleObject WideCharToMultiByte OpenProcess Sleep ExpandEnvironmentStringsW GetStartupInfoW CreateProcessW GetCommandLineW VerifyVersionInfoW GetComputerNameW lstrcmpW LocalFree VirtualQuery GetCurrentProcessId VerSetConditionMask MoveFileW SetFileAttributesW RemoveDirectoryW CreateDirectoryW GetNumberFormatEx GetLocaleInfoW GetTimeFormatW GetDateFormatW GlobalAlloc Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetFileInformationByHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime MultiByteToWideChar lstrcmpiW LoadLibraryExW SetThreadPriority GetCurrentThread ReadConsoleW DecodePointer SetCurrentDirectoryW FormatMessageW GetModuleHandleExW GetModuleFileNameA DebugBreak lstrlenW MulDiv LoadLibraryW FreeLibrary GetThreadId CloseHandle GetTempPathW WriteFile GetTempFileNameW DeleteFileW CreateFileW GetModuleFileNameW GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RaiseException GetPrivateProfileStringW GetPrivateProfileIntW GetFileAttributesW GetProcAddress GetModuleHandleW GetCurrentProcess FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GlobalLock GlobalUnlock

user32

EmptyClipboard OpenClipboard SendMessageW DialogBoxIndirectParamW CloseClipboard EnumDisplaySettingsW FindWindowExW FindWindowW SetForegroundWindow WaitForInputIdle IsDlgButtonChecked CheckDlgButton EnableWindow GetDlgItemTextW MonitorFromPoint IsDialogMessageW DestroyMenu SetMenuItemInfoW GetSysColor LoadImageW IsRectEmpty SetClipboardData DrawIconEx DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW SetFocus GetFocus SetTimer KillTimer DrawTextW BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect CheckMenuRadioItem GetWindowThreadProcessId GetDesktopWindow SetRectEmpty SetRect WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos MessageBeep AdjustWindowRectEx SetMenuDefaultItem GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenuEx DeleteMenu RemoveMenu ModifyMenuW AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu EnableMenuItem CreatePopupMenu GetMenuStringW SetMenu GetMenu TranslateAcceleratorW ReleaseCapture SetCapture GetCapture GetKeyState GetActiveWindow CharLowerW GetDlgCtrlID DialogBoxParamW CreateDialogParamW SetWindowPlacement GetWindowPlacement IsMenu PostQuitMessage GetMessagePos DrawFrameControl DrawEdge TrackMouseEvent RegisterWindowMessageW LoadStringA EnumChildWindows MessageBoxW LoadMenuW LoadAcceleratorsW CharNextW DestroyWindow IsWindow PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW LoadIconW GetDlgItem GetWindow MapWindowPoints GetWindowRect SetDlgItemTextW EndDialog GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW GetScrollInfo SetScrollInfo DestroyIcon CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongW PtInRect OffsetRect InflateRect CopyRect FrameRect FillRect DrawFocusRect ScreenToClient ShowScrollBar SetScrollPos RedrawWindow ReleaseDC GetWindowDC GetDC UpdateWindow GetSystemMetrics IsWindowEnabled IsZoomed IsWindowVisible SetWindowPos MoveWindow ShowWindow IsChild PostMessageW GetSysColorBrush LoadCursorW GetParent SetWindowLongW GetWindowLongW

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject SetBkColor ExtTextOutW SetViewportOrgEx CreateFontIndirectW SetBkMode SetTextColor GetObjectW CreateSolidBrush CreatePen GetDeviceCaps GetStockObject GetTextExtentPoint32W LineTo Rectangle SetTextAlign MoveToEx TextOutW Polyline CreateBitmap CreatePatternBrush GetCurrentObject CreateDIBSection Polygon SetBrushOrgEx SetMapMode StartDocW EndDoc StartPage EndPage PatBlt ExcludeClipRect

comdlg32

PrintDlgW ChooseFontW FindTextW GetOpenFileNameW GetSaveFileNameW

advapi32

RegDeleteKeyW CryptAcquireContextW CryptReleaseContext CryptHashData CryptGetHashParam RegLoadMUIStringW LookupPrivilegeValueW AdjustTokenPrivileges QueryServiceConfig2W RegGetValueW RegOpenKeyW RegCreateKeyW RegRenameKey RegEnumValueW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle ConvertStringSidToSidW LookupAccountSidW RegCopyTreeW RegDeleteTreeW RegQueryValueExW ConvertSidToStringSidW RegLoadKeyW IsValidSid GetTokenInformation GetLengthSid CopySid OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW GetServiceDisplayNameW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptCreateHash

shell32

SHGetStockIconInfo SHEvaluateSystemCommandTemplate ExtractIconExW SHGetKnownFolderPath ShellExecuteW ExtractAssociatedIconW CommandLineToArgvW ShellExecuteExW

ole32

CoUninitialize StringFromGUID2 CLSIDFromString CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance StgCreateStorageEx StgOpenStorageEx CoInitializeEx

oleaut32

SysStringLen VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString

shlwapi

SHCreateStreamOnFileW SHAutoComplete

comctl32

ImageList_GetImageCount ImageList_Destroy ImageList_Draw ImageList_DrawIndirect ImageList_WriteEx ImageList_Read ImageList_GetIcon ImageList_ReplaceIcon ImageList_Duplicate CreateStatusWindowW ImageList_DragShowNolock InitCommonControlsEx ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_GetIconSize ImageList_DrawEx ImageList_AddMasked ImageList_Create

uxtheme

IsThemeActive SetWindowTheme IsAppThemed

msimg32

GradientFill

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

dwmapi

DwmSetWindowAttribute DwmDefWindowProc

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpConnect

crypt32

CertGetNameStringW