Overview

overview

4

Static

static

1

PowerRun_x64.exe

windows7-x64

4

PowerRun_x64.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    135s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2023 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PowerRun_x64.exe

  • Size

    923KB

  • MD5

    efe5769e37ba37cf4607cb9918639932

  • SHA1

    f24ca204af2237a714e8b41d54043da7bbe5393b

  • SHA256

    5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

  • SHA512

    33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

  • SSDEEP

    24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe" /P:786544
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
      • C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe" /P:786544
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3948
        • C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\PowerRun_x64.exe" /TI/ /P:786544
          4⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:232

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PowerRun.ini
    Filesize

    3KB

    MD5

    e7195e915245d64a19ec69a3562c183c

    SHA1

    9eb05bfdd79c74b15f024eee2cf0e36c5546a828

    SHA256

    359f2e233456fbb74e0887a09f5ccf5fd0024a47c8cf1546d9bf63991b502f52

    SHA512

    c2b837952962654023641e591ea2d3ff102745686ee313614e0604f4dbadef9be92406e9788d56ddd854d8f888e43b637a23f6426ae8a08069df5e25ad4651d3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vlaxqjs
    Filesize

    81KB

    MD5

    940b1915cadee0e2b33d80799816f6c7

    SHA1

    2c10e4fec3e8c054055d1ed78757117575f273f2

    SHA256

    81e89e7266cfe5158e44f5578c8be61353e781daebdd47a33597e9ec503d379c

    SHA512

    cc3c574fd5392c1b54146b591e22b1c01c95e34a602c403ad96c49b7ee6ad31d1478a00cc1334286addc5cb94496372a172745e9ad20554023e1e22c7da1e1c5

    Download Submit

  • C:\Windows\Temp\autB9CF.tmp
    Filesize

    25KB

    MD5

    436c1bb98deeccecb73fad945f1dd3dc

    SHA1

    774313ba911945589971bbc73498d81f060dabe6

    SHA256

    05eae1691149cc66e458d5e5b4430bd3b938b278b8bdb2c887a13c9871004c51

    SHA512

    66ea41b9b4a42f7c40d1ce5b6e82a6f03e8489648b912d96a81efa13d340d4d651078df7c1302c595ca83408e7208d1d79f02165dc27383952a9abe7f851c3e2

    Download Submit