9df41ebe1a2c61bbc382a85a7788e127e4dafada4955a1b6c3dfcaf460bd714f

Resubmissions

09/07/2024, 13:39

240709-qydwdayanf 7

09/07/2024, 07:52

09/07/2024, 06:42

09/07/2024, 06:34

09/07/2024, 05:47

Analysis

max time kernel
78s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

powercfg.exe
Size

116KB
MD5

5ec8e8f2994af3fde376d4c19ed979bb
SHA1

b902a24582a7330eb6e75131e71452bee927b845
SHA256

0b115b47d3ed8b00e97138afbae094db8cfee6e108d301fbb090368aefbb68be
SHA512

37c440008b0baad0e4f1bf5b8eb608cdc2c0626f972ec6ad5921d135009fecafbb4714fa5d17669e6b1f50e6407082214b3a95cae45d936be07174dc42a70f17
SSDEEP

1536:0jcdiI1HJ5eXTwY7NHxAw81iMuuZl8sVRByoI3QwjHkGb6mzNM+mM4MmkVNi+O:0ZCr6NOw81iMuussrQoVGbBRrmMD2

Score

6^/10

persistence

Malware Config

Signatures

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1008	powercfg.exe

C:\Users\Admin\AppData\Local\Temp\powercfg.exe
"C:\Users\Admin\AppData\Local\Temp\powercfg.exe"
1⤵
- Power Settings
PID:1008

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv cgeSIQ8pekCsulAaNaozIw.0
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...