445bc69abbd0eba7c5c4092561043eb80cde9ce361d970782837431f23460e87

Analysis

max time kernel
147s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fps boost tweak/3 Power Plan/2 Delete Other Power Plans.cmd
Size 237B
Sample240626-v73cjsvdmc
SHA256 0203f29948d95cb2057e5dda1a980f218437fb3f54082d17c23b70b95616d80f
MD5 4f5e9d985ba5e71a95b3245d0155dbcb
SHA1 e89303b70425a043e83bce48ce793ad55ce1e38f
SHA512 37c6da4dbbe327489292240ed9260f27e4c2e0678b97a82a808ead7e12a9ec2133efe3085eda60a2b5000191dcefd5b161f1cce3e8a56a02082628b4409804f3
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3536	powercfg.exe
3548	powercfg.exe
2560	powercfg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3548	powercfg.exe
Token: SeCreatePagefilePrivilege	3548	powercfg.exe
Token: SeShutdownPrivilege	2560	powercfg.exe
Token: SeCreatePagefilePrivilege	2560	powercfg.exe
Token: SeShutdownPrivilege	3536	powercfg.exe
Token: SeCreatePagefilePrivilege	3536	powercfg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3548	2360	cmd.exe	78
PID 2360 wrote to memory of 3548	2360	cmd.exe	78
PID 2360 wrote to memory of 2560	2360	cmd.exe	79
PID 2360 wrote to memory of 2560	2360	cmd.exe	79
PID 2360 wrote to memory of 3536	2360	cmd.exe	80
PID 2360 wrote to memory of 3536	2360	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fps boost tweak\3 Power Plan\2 Delete Other Power Plans.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\powercfg.exe
  powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\powercfg.exe
  powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\powercfg.exe
  powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads