edf42b5c9ac99d9bb932c536deb6a5f497450750f032c2e7ef9f9d1cd7b6365b

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQMusic/AutoPowerOff.exe
Size

12KB
MD5

df44e3df4c844d42df8b97dc366ee106
SHA1

6f5e4d0261b05ab0f49d70f50aadeb1c313a2a79
SHA256

54ad0c77d189c9ed72fbad94bb3f775ada8d716d8caf95298b062a3d34a44d1a
SHA512

ca732e7fe7b284709aff039cc4bf49d776a52882d6d2841fede95ee7e01634ce118d2d8ae9f5a1a65efe0954b8c04aa3ff1fd6c470c1d6c7d94ddb1797b4da4b
SSDEEP

192:7A5qIaeuZzcq+twXE9Mt6dkqf5HSfpyowJL/8Qpkqs1Iu55+ebCfN5497X:7oq44EtAE9i6ZHSRYJLu1vPbCzqX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoPowerOff.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4596	AutoPowerOff.exe

C:\Users\Admin\AppData\Local\Temp\QQMusic\AutoPowerOff.exe
"C:\Users\Admin\AppData\Local\Temp\QQMusic\AutoPowerOff.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads