a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PowerRun.exe
Size

873KB
MD5

fc1fb033d57f72089fb4762245a8b18d
SHA1

7ec0f7ca5f0e0d20e5372bf69865d0a809e6cc8e
SHA256

a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2
SHA512

cff3833e592a5fe1f1fcb656c42e77fdd177c902f84cf396365cfa04edc9ec046de3473a943779d3815bc36bf48182101703b20b08ae580c2b3ba20508d231d0
SSDEEP

24576:g2DW/xbWX2YIb3Qsu3/PNL3Q7HybtTpAA+c:g2EaXSQsW/PNjQLY9ARc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2552	PowerRun.exe
2552	PowerRun.exe
920	PowerRun.exe
920	PowerRun.exe
920	PowerRun.exe
920	PowerRun.exe
1948	PowerRun.exe
1948	PowerRun.exe
1948	PowerRun.exe
1948	PowerRun.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2552	PowerRun.exe
3312	PowerRun.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	PowerRun.exe
Token: SeAssignPrimaryTokenPrivilege	920	PowerRun.exe
Token: SeIncreaseQuotaPrivilege	920	PowerRun.exe
Token: 0	920	PowerRun.exe
Token: SeDebugPrivilege	1948	PowerRun.exe
Token: SeAssignPrimaryTokenPrivilege	1948	PowerRun.exe
Token: SeIncreaseQuotaPrivilege	1948	PowerRun.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 920	2552	PowerRun.exe	84
PID 2552 wrote to memory of 920	2552	PowerRun.exe	84

C:\Users\Admin\AppData\Local\Temp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\PowerRun.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\PowerRun.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerRun.exe" /P:328208
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- - C:\Users\Admin\AppData\Local\Temp\PowerRun.exe
    "C:\Users\Admin\AppData\Local\Temp\PowerRun.exe" /P:328208
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\PowerRun.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerRun.exe" /TI/ /P:328208
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2c5c5e2g.tmp

Filesize
28KB

MD5
9e7bb9c31083cc3a0f561d12311c9d83

SHA1
9102b88339566d5f0490c25180632043c8bb1809

SHA256
2658178fd2cb498195032c531bf3bb037954e0614aaec4c4ac2637f08d949bc1

SHA512
1fb30279a1f951a98f609eb749deb6c77082c28a30e1fdd4f3224ddac8ddfad134e8f3c44f82c32501da8a93a978e6cf8dfe591039a0e6af0d4d2a1dc5445699

Download Submit
C:\Users\Admin\AppData\Local\Temp\PowerRun.ini

Filesize
3KB

MD5
c029fc461140de09ddd77752c6682344

SHA1
3b243fca2b642b8e42c812dcf66743e9429c7172

SHA256
2c40bc461a94c92aaa3ded45f389a09ab535a396b41cf7864405e181c7a5ebbd

SHA512
1f2efd9877ed65ed67bf2dbb2a53fbd27cba7de0c15e2304003b04135af2f1feca720b25166d8bf6bd99b947605590dccec27ab24dd0620b4eb8338031d31fe1

Download Submit
C:\Windows\Temp\aut3577.tmp

Filesize
11KB

MD5
4a83df1d945c2f5801ed59650d7460eb

SHA1
31827890e1df99268c0f80dcb26774225e4c3a5d

SHA256
2d993be76dfcf35f89b656b4dbc553e078d824974b482e56c6f76eaea87731c8

SHA512
eacb88683e3c999a1cdc9d9e4a4030723164e358d7cd85f7cfc02b99f33be991c89af5602349b48b5388520968a43a2a45b4b6d2f468f2b888088cf95bd591d2

Download Submit
C:\Windows\Temp\aut3588.tmp

Filesize
10KB

MD5
09ca17eb552722bd7004097f59b07518

SHA1
36cf9da188460542e58acb97fa0ef0bfd9a4e172

SHA256
365c32c3c09228158ab5aaabfcf93cdfcd858be0b2a00031d82ab03070f61a5b

SHA512
3dc6ed86df50f87b12635032fb30840e94bea699ac193a16099a2ce1a9bd5e39147f115fb938c177991dc0dcfd5abab075632a1d0b46e6009a86eea3a27156bf

Download Submit
C:\Windows\Temp\aut3589.tmp

Filesize
5KB

MD5
96c0e61f3298cb745b021f67e7dd0d48

SHA1
a61adbe460c68a3087ff1ba75620dbb86af28e40

SHA256
3e56c22a81ab1168036a289c7ffe2889dd678c422568dff9ef91d6a0f9005333

SHA512
dbbfdd4ad2c80ff9df0b21dfd011420baba54a7114d0e0ff5371dda9c9389d90422a4311881ac2bdb5ba7c4334d210b61c6c0fc691ae503e32930109d9251f3e

Download Submit