b4bb497039f2c1ca8c7eaf592bf32566b8fbb2f657f23555bb14c4d24db3c622

Resubmissions

09/08/2024, 21:36

240809-1f9kfatgrg 6

09/08/2024, 21:26

240809-1an2jstend 8

Analysis

max time kernel
138s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KASU PACK V.3/Power Plan/Max Performance (RUN AS ADMIN).bat
Size

471B
MD5

3955511f0b30a32f197f5a9084486581
SHA1

da0d23655d211fd83fd14cc12c6750baa4469b06
SHA256

937a072d2780b3249c12596dfa529dc9fae5f752d567f3e3b7122e8ea941cec1
SHA512

301030409d3106a9b5ae2c75a31853b4da305297003444297b59217c5b17ee262563be935797a5d0fe5fea6cd454b79a84f2ade2655c2a3916fc0669f5270b8e

Score

6^/10

persistence

Malware Config

Signatures

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
208	powercfg.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2580	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	208	powercfg.exe
Token: SeCreatePagefilePrivilege	208	powercfg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 208	3496	cmd.exe	85
PID 3496 wrote to memory of 208	3496	cmd.exe	85
PID 3496 wrote to memory of 2580	3496	cmd.exe	86
PID 3496 wrote to memory of 2580	3496	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KASU PACK V.3\Power Plan\Max Performance (RUN AS ADMIN).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\system32\powercfg.exe
  powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...