MALICIOUS — POWRPROF.dll
MALICIOUS — POWRPROF.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the execute family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
1967b3daab7f8801382dbca60d32b641b4c920daf92c99501566f9bc954fd721 - SHA-1:
d26bcd272b21ae2379e8ea88d6499a463d730f14 - MD5:
f2e5594779b3eb2f03907eed2bb5b225 - imphash:
b1c022f21e313c400a3bd74350a836c9 - ssdeep:
98304:ZyBcGcxAmD+IiyzCOq7qDG1W6Bc5diIubbXPhkUWdU+22pM0ro250wmpfXfKhz5:ZyTlmSIiyqGDM7CdiIu3PSUN2v70wKS - TLSH:
T15A61C07A062F3490E0FEA9A4BC4C2ECCD0E571799433AB558543CF0E580195BAEE746E - Submitted as: POWRPROF.dll
- File type: pe · Size: 4075008 bytes
- Verdict: malicious (92/100) · Family: execute
Detections (5 of 53 engines)
- capa (capabilities): execute via PowerShell
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win64/Aotera.DSY!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKD.80947303
- Kaspersky (KVRT): UDS:Trojan.Win64.Agent
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 9 weighted signals:
- Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7252) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80947303 (rule
Trojan.GenericKD.80947303) - engine signal, weight 0.55, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 4.2.1.0 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
55 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.bing.com
- desktop-hsgcbep
- config.edge.skype.com
- to-do.microsoft.com
- dns.msftncsi.com
- tas02.sls.update.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- teams.microsoft.com
- aps.prod.windows.com
- watson.events.data.microsoft.com
Dropped files
- c4651706c8849220b0f8edbbf3a09dea185ce5d0c478f572898ae3cb85419de0 -
c4651706c8849220b0f8edbbf3a09dea185ce5d0c478f572898ae3cb85419de0
Embedded URLs
- https://aka.ms/nativeaot-compatibilit
Embedded domains
- aka.ms
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.cloud.microsoft
- searchapp.bundleassets.example
- www.msftconnecttest.com
- outlook.office.com
- outlook.office365.com
- www.bing.com
- config.edge.skype.com
- to-do.microsoft.com
- dns.msftncsi.com
- tas02.sls.update.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- teams.microsoft.com
- aps.prod.windows.com
- watson.events.data.microsoft.com
- ecs.office.com
- g.live.com
- fs.microsoft.com
- self.events.data.microsoft.com
- www.msftncsi.com
Embedded IP addresses
- 4.2.1.0
More execute samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report