159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

CL_RemoveNoOffice.ps1
Size

18KB
MD5

fe5cb29caac4f0f3ea6ed3a64ff28aed
SHA1

1a9a9fa0b3734fd0fefc034dbf1efb2db6b52de0
SHA256

359977958b9947720cb1022b9f7b6a8ea38aa402801576e5b232af291de7bc34
SHA512

0baf2128208129b782a1817c537f545952861e400d3763ce315c8d185ac003567c9511766f044e62d67a5e5080309371cc49e7b1a37ea569e076edf74f02db6d

Score

1^/10

Modifies registry class 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe

pid process

1584 powershell.exe
1584 powershell.exe
1584 powershell.exe
1584 powershell.exe
1584 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1584 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1584	powershell.exe

memory/1584-0-0x000007FEF5D30000-0x000007FEF671C000-memory.dmp

Filesize
9.9MB

Download
memory/1584-1-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1584-2-0x000000001AC70000-0x000000001AC71000-memory.dmp

Filesize
4KB

Download
memory/1584-3-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1584-4-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1584-5-0x000000001C2B0000-0x000000001C2B1000-memory.dmp

Filesize
4KB

Download
memory/1584-6-0x000000001C650000-0x000000001C651000-memory.dmp

Filesize
4KB

Download
memory/1584-7-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1584-10-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1584-22-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/1584-23-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download