dff3d7a15b8ff7fada4397088a658bc79d47c0d387ee9a3c710490d73983395a

Analysis

max time kernel
16s
max time network
19s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 12:50

Reason

Machine shutdown

Target

settings.ps1
Size

21KB
MD5

d4a8463332d11c465c311485626a089e
SHA1

ddc07ff6160187c0b48d9b1d34aa05af90483bd9
SHA256

dff3d7a15b8ff7fada4397088a658bc79d47c0d387ee9a3c710490d73983395a
SHA512

1b385c68fc3e6212c5339b7cfb23816c9ad9bbf9c8c42d817a85b6f26b8014b238815819ff8de4cc79c4fc095be4d5b8a111b3b20c5e695f502fce7bbdc40217
SSDEEP

384:QcyvJh/drDCNrr2YyHEHaeizHlf2GkxUtJNFw5ARMthKqsvvvhUvhkvkNp8mpdFm:QcyvJh/drDCNrr2Yyk6eizFf2GkxUtJb

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1868	powershell.exe
4	1868	powershell.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nuefwb2_y.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nuefwb2_.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nuefwb2_EX.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nuefwb2_AT.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_nuefwb2_AA.lnk	powershell.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings\Shell\Open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings\Shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings\Shell\Open	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings\Shell\Open\command\DelegateExecute	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\ms-settings\Shell\Open\command\ = "C:\\_nuefwb2_\\_nuefwb2_i7.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeShutdownPrivilege	2072	shutdown.exe
Token: SeRemoteShutdownPrivilege	2072	shutdown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2072	1868	powershell.exe	29
PID 1868 wrote to memory of 2072	1868	powershell.exe	29
PID 1868 wrote to memory of 2072	1868	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\settings.ps1
1⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\shutdown.exe
  "C:\Windows\system32\shutdown.exe" /r /t 10
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

memory/1868-4-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/1868-6-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1868-5-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1868-7-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1868-8-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1868-9-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1868-10-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1868-11-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1868-26-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1868-27-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2280-29-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/2592-28-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download