File name:

PowerTool.exe

Full analysis: https://app.any.run/tasks/9e231632-5f99-4345-9952-c1fc0d849dd4
Verdict: Malicious activity
Analysis date: August 29, 2024, 00:43:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
antivm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C6C83C56828ABD35AE26EDCF1C9F5C52

SHA1:

E83BD640CDF03062B2908BF0838AA41141E60DAB

SHA256:

7BEB412328E9DE44269C45E74D0D75BAEFE02BA2138F5F99D0FE334BB73C8603

SSDEEP:

98304:LYfXj5y7qCmW5IvkS/umyQBo352xApXWlLB0lI+50guSOSSxe56bUBpY1Zg:7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes the SafeBoot registry key

      • PowerTool.exe (PID: 7132)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • PowerTool.exe (PID: 7132)

    • Creates file in the systems drive root

      • PowerTool.exe (PID: 7132)

    • Executable content was dropped or overwritten

      • PowerTool.exe (PID: 7132)

    • Drops a system driver (possible attempt to evade defenses)

      • PowerTool.exe (PID: 7132)

    • Creates or modifies Windows services

      • PowerTool.exe (PID: 7132)

    • There is functionality for VM detection (VirtualBox)

      • PowerTool.exe (PID: 7132)

  • INFO

    • Create files in a temporary directory

      • PowerTool.exe (PID: 7132)

    • Checks supported languages

      • PowerTool.exe (PID: 7132)

    • Reads the computer name

      • PowerTool.exe (PID: 7132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:01:27 10:37:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 2681344
InitializedDataSize: 2184704
UninitializedDataSize: -
EntryPoint: 0x23d902
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.0
ProductVersionNumber: 1.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
Comments: 手工杀毒(64位)
CompanyName: http://www.weibo.com/powertool
FileDescription: Anti-virus/rootkit/bootkit Tool(64 bit)
FileVersion: 1.6.0.0
InternalName: PowerTool.exe
LegalCopyright: Copyright @ 2010-2014. By ithurricane. All rights reserved.
OriginalFileName: PowerTool.exe
ProductName: PowerTool
ProductVersion: 1.6.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT powertool.exe sppextcomobj.exe no specs slui.exe no specs powertool.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1780"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6780C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6852"C:\Users\admin\AppData\Local\Temp\PowerTool.exe" C:\Users\admin\AppData\Local\Temp\PowerTool.exe—explorer.exe
User:
admin
Company:
http://www.weibo.com/powertool
Integrity Level:
MEDIUM
Description:
Anti-virus/rootkit/bootkit Tool(64 bit)
Exit code:
3221226540
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\powertool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7132"C:\Users\admin\AppData\Local\Temp\PowerTool.exe" C:\Users\admin\AppData\Local\Temp\PowerTool.exe
explorer.exe
User:
admin
Company:
http://www.weibo.com/powertool
Integrity Level:
HIGH
Description:
Anti-virus/rootkit/bootkit Tool(64 bit)
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\powertool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 194
Read events
1 158
Write events
24
Delete events
12

Modification events

(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kEvP64
Operation:writeName:Type
Value:
1
(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kEvP64
Operation:writeName:ErrorControl
Value:
0
(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kEvP64
Operation:writeName:Start
Value:
3
(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kEvP64
Operation:writeName:ImagePath
Value:
\??\C:\Users\admin\AppData\Local\Temp\kEvP64.sys
(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\kEvP64.sys
Operation:delete keyName:(default)
Value:
(PID) Process:(7132) PowerTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kEvP64
Operation:delete keyName:(default)
Value:
Executable files
6
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7132PowerTool.exeC:\Users\admin\AppData\Local\Temp\kEvP64.sysexecutable
MD5:6A3C4F8EE788940C3ACCAD9473152653
SHA256:081BFA805B558FEDF8A8549594AD1EF9A5209F2A23A48F4AB06AABF6DF6C6E79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
23
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6120
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6880
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
608
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6264
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
608
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
20.10.31.115:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6120
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6120
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6880
SIHClient.exe
52.165.165.26:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 20.44.239.154
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 20.10.31.115
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
Process
Message
PowerTool.exe
0, 0
PowerTool.exe
error0
PowerTool.exe
c:\windows\[system
PowerTool.exe
4, 100983048
PowerTool.exe
108, 12
PowerTool.exe
error0
PowerTool.exe
C:\WINDOWS\registry
PowerTool.exe
408, 12
PowerTool.exe
524, 12
PowerTool.exe
612, 12
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PowerTool.exe