50fdd1a3a1fdccbe8a57ffdeed3f550398187f8de66e79d36e48dc0eb49fd2e7

Reason

Machine shutdown

General

Target

8.ps1
Size

19KB
MD5

1a5c933e83fc3395e8e5f737df0be1de
SHA1

c1b72ce34210b50699c729a403683e31a87970af
SHA256

50fdd1a3a1fdccbe8a57ffdeed3f550398187f8de66e79d36e48dc0eb49fd2e7
SHA512

698d9c0657ac978362be8c0c1aba23e72e1469073354f1e3a8b8e40fc79affc0383f4bfa4161e377d4304b314a8b03721efb9414413c13489addb7580718785c
SSDEEP

384:QcyvJvDCNrr2YyHEHaeizHlf2GkxUtJNzw5ARMthKqsvvvhUvhkvkNp8mpdIc+ZW:QcyvJvDCNrr2Yyk6eizFf2GkxUtJNYtH

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	924	powershell.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nybspe2_V.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nybspe2_VEX.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nybspe2_VAT.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nybspe2_VAA.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nybspe2_Vy.lnk	powershell.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "37"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings\Shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings\Shell\Open	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings\Shell\Open\command\ = "C:\\_nybspe2_V\\_nybspe2_Vi7.exe"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\ms-settings\Shell\Open\command	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
924	powershell.exe
924	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	powershell.exe
Token: SeShutdownPrivilege	4924	shutdown.exe
Token: SeRemoteShutdownPrivilege	4924	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
368	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4924	924	powershell.exe	83
PID 924 wrote to memory of 4924	924	powershell.exe	83

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8.ps1
1⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\shutdown.exe
  "C:\Windows\system32\shutdown.exe" /r /t 10
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4924

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ed855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otz1mmgv.nhy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/924-16-0x00000245F9CE0000-0x00000245F9CFE000-memory.dmp

Filesize
120KB

Download
memory/924-34-0x00000245F9B00000-0x00000245F9B10000-memory.dmp

Filesize
64KB

Download
memory/924-12-0x00007FFC07230000-0x00007FFC07CF1000-memory.dmp

Filesize
10.8MB

Download
memory/924-11-0x00000245F95E0000-0x00000245F95F0000-memory.dmp

Filesize
64KB

Download
memory/924-13-0x00000245F9B00000-0x00000245F9B10000-memory.dmp

Filesize
64KB

Download
memory/924-14-0x00000245FAA70000-0x00000245FAB72000-memory.dmp

Filesize
1.0MB

Download
memory/924-15-0x00000245FA9E0000-0x00000245FAA56000-memory.dmp

Filesize
472KB

Download
memory/924-0-0x00000245F9D20000-0x00000245F9DA2000-memory.dmp

Filesize
520KB

Download
memory/924-7-0x00000245F9C90000-0x00000245F9CB2000-memory.dmp

Filesize
136KB

Download
memory/924-17-0x00000245F9D00000-0x00000245F9D1E000-memory.dmp

Filesize
120KB

Download
memory/924-33-0x00007FFC07230000-0x00007FFC07CF1000-memory.dmp

Filesize
10.8MB

Download
memory/924-36-0x00000245F9B00000-0x00000245F9B10000-memory.dmp

Filesize
64KB

Download
memory/924-38-0x00000245F9B00000-0x00000245F9B10000-memory.dmp

Filesize
64KB

Download
memory/924-39-0x00000245FACF0000-0x00000245FAD04000-memory.dmp

Filesize
80KB

Download
memory/924-40-0x00000245FAD10000-0x00000245FAD22000-memory.dmp

Filesize
72KB

Download
memory/924-41-0x00000245FA9C0000-0x00000245FA9CA000-memory.dmp

Filesize
40KB

Download
memory/924-67-0x00000245F9B00000-0x00000245F9B10000-memory.dmp

Filesize
64KB

Download
memory/924-73-0x00007FFC07230000-0x00007FFC07CF1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors