c65ecdd604d1bfc9f7ad01cdf88cbe25a2559c5585f4db1b3d341b0a22c64d9e

Reason

Machine shutdown

General

Target

dropper8marzo.ps1
Size

23KB
MD5

334d2d891fd5710afc216ea66cae4c22
SHA1

6bc5801b90f7dc53847ea4628611fd6772213112
SHA256

c65ecdd604d1bfc9f7ad01cdf88cbe25a2559c5585f4db1b3d341b0a22c64d9e
SHA512

a80feb1ff14cf24bda9d8b292be13ad1066b2c9b72425eac83e5d3dbc54aeaed8116b421ba1de21649e4c510e2a96e8c5f0a8460a3498e4d09b2cd8d40d0b72f
SSDEEP

384:GNAnhcaViWyW+ud7/HWH5jbwHcGlftuLGuIwPwNhODLMVqVGGGMrGMbGba0NX0aZ:GNAnhcaViWyW+ud7/2Zjbw8GlftuLGus

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
7	2368	powershell.exe
14	2368	powershell.exe
25	2368	powershell.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_bdhtwn3_RAT.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_bdhtwn3_RAA.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_bdhtwn3_Ry.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_bdhtwn3_R.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_bdhtwn3_REX.lnk	powershell.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "24"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings\Shell\Open\command\ = "C:\\_bdhtwn3_R\\_bdhtwn3_Ri7.exe"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings\Shell\Open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings\Shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\ms-settings\Shell\Open	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	800	shutdown.exe
Token: SeRemoteShutdownPrivilege	800	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2580	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 800	2368	powershell.exe	93
PID 2368 wrote to memory of 800	2368	powershell.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\dropper8marzo.ps1
1⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\shutdown.exe
  "C:\Windows\system32\shutdown.exe" /r /t 15
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:800

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394d055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fd4eflhb.a0f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2368-9-0x00000297426B0000-0x00000297426D2000-memory.dmp

Filesize
136KB

Download
memory/2368-10-0x00007FFCCDF00000-0x00007FFCCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2368-11-0x0000029742710000-0x0000029742720000-memory.dmp

Filesize
64KB

Download
memory/2368-12-0x000002975B960000-0x000002975B9D6000-memory.dmp

Filesize
472KB

Download
memory/2368-13-0x000002975B880000-0x000002975B89E000-memory.dmp

Filesize
120KB

Download
memory/2368-30-0x0000029742710000-0x0000029742720000-memory.dmp

Filesize
64KB

Download
memory/2368-33-0x00007FFCCDF00000-0x00007FFCCE9C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors