8b1813aef6ef673d4a0973bbf426857d251c21e71889376ba581652b5e56e4f3

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

380KB
MD5

a0c71ff42da76357bfb0a0ac582fbe51
SHA1

0745f5f58ebe368f3fe96eb5fd08aad71bcff8ca
SHA256

8b1813aef6ef673d4a0973bbf426857d251c21e71889376ba581652b5e56e4f3
SHA512

aa6bec2311fadfa245351fc4039ef8167ac9e001607522e72df528810b435e9ac594be7f0db0ae1701d8a6a1c12e006290eae547d9f7a6d2747a487499133390
SSDEEP

6144:x/QiQXCrkm+ksmpk3U9j0IHOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7Lk0:pQi3rP6m6UR0IHlL//plmW9bTXeVhDrE

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

file.tmpPowerOff.exe

pid process

4244 file.tmp
988 PowerOff.exe
Loads dropped DLL 1 IoCs

Processes:

file.tmp

pid process

4244 file.tmp
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 988 WerFault.exe PowerOff.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PowerOff.exe

description pid process

Token: SeDebugPrivilege 988 PowerOff.exe

pid	process
4244	file.tmp
988	PowerOff.exe

pid	process
4244	file.tmp

pid	pid_target	process	target process
1220	988	WerFault.exe	PowerOff.exe

description	pid	process
Token: SeDebugPrivilege	988	PowerOff.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

file.exefile.tmp

description	pid	process	target process
PID 1676 wrote to memory of 4244	1676	file.exe	file.tmp
PID 1676 wrote to memory of 4244	1676	file.exe	file.tmp
PID 1676 wrote to memory of 4244	1676	file.exe	file.tmp
PID 4244 wrote to memory of 988	4244	file.tmp	PowerOff.exe
PID 4244 wrote to memory of 988	4244	file.tmp	PowerOff.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\is-LKVNV.tmp\file.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LKVNV.tmp\file.tmp" /SL5="$30028,140559,56832,C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Local\Temp\is-RPKPK.tmp\PowerOff.exe
"C:\Users\Admin\AppData\Local\Temp\is-RPKPK.tmp\PowerOff.exe" /S /UID=95
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 988 -s 1484
4⤵
- Program crash
PID:1220

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 988 -ip 988
1⤵
PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-LKVNV.tmp\file.tmp

Filesize
694KB

MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RPKPK.tmp\PowerOff.exe

Filesize
297KB

MD5
c34836636624cc3b5a7566743b7a1931

SHA1
6c61def45f28d9d324e027a77927f9ba8179c3f3

SHA256
9dc0f11a787e6c1effbcaf3e1d98a5748f1c29677ba4f8d0d1a552236bf7c1b9

SHA512
0e1a1bb6a1e0fbb860e76f0f3f1f3b8b5449ddb67b705e86b4982eff62ed12960ae1ca9c3754215a6976613c5ddfb9e6c1e0c8e441dc183a52e5e8e5373f8146

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RPKPK.tmp\PowerOff.exe

Filesize
297KB

MD5
c34836636624cc3b5a7566743b7a1931

SHA1
6c61def45f28d9d324e027a77927f9ba8179c3f3

SHA256
9dc0f11a787e6c1effbcaf3e1d98a5748f1c29677ba4f8d0d1a552236bf7c1b9

SHA512
0e1a1bb6a1e0fbb860e76f0f3f1f3b8b5449ddb67b705e86b4982eff62ed12960ae1ca9c3754215a6976613c5ddfb9e6c1e0c8e441dc183a52e5e8e5373f8146

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RPKPK.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
memory/988-138-0x0000000000000000-mapping.dmp

Download
memory/988-141-0x0000000000D60000-0x0000000000DB0000-memory.dmp

Filesize
320KB

Download
memory/988-142-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Filesize
10.8MB

Download
memory/988-144-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Filesize
10.8MB

Download
memory/988-145-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Filesize
10.8MB

Download
memory/1676-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1676-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1676-143-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1676-146-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4244-135-0x0000000000000000-mapping.dmp

Download