The user of the Accounting workstation reported thattheir calculator repeatedly opens without their input.

To generate theSHA256 checksumof the file that triggeredRuleName: Suspicious PowerShellon theAccounting workstation, follow these detailed steps:

Step 1: Establish an SSH Connection

Open a terminal on your system.

Use the provided credentials to connect to theAccounting workstation:

ssh Accounting@

Replace with the actual IP address of the workstation.

Enter the password when prompted:

1x-4cc0unt1NG-x1

Step 2: Locate the Malicious File

Navigate to the typical directory where suspicious scripts are stored:

cd C:\Users\Accounting\AppData\Roaming

List the contents to identify the suspicious file:

dir

Look for a file related toPowerShell(e.g., calc.ps1), as the issue involved thecalculator opening repeatedly.

Step 3: Verify the Malicious File

To ensure it is the problematic file, check for recent modifications:

powershell

Get-ChildItem -Path "C:\Users\Accounting\AppData\Roaming" -Recurse | Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-1) }

This will list files modified within the last 24 hours.

Check file properties:

powershell

Get-Item "C:\Users\Accounting\AppData\Roaming\calc.ps1" | Format-List *

Confirm it matches the file flagged byRuleName: Suspicious PowerShell.

Step 4: Generate the SHA256 Checksum

Method 1: Using PowerShell (Recommended)

Run the following command to generate the hash:

powershell

Get-FileHash "C:\Users\Accounting\AppData\Roaming\calc.ps1" -Algorithm SHA256

Output Example:

mathematica

Algorithm Hash Path

--------- ---- ----

SHA256 d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d C:\Users\Accounting\AppData\Roaming\calc.ps1

Method 2: Using certutil (Alternative)

Run the following command:

cmd

certutil -hashfile "C:\Users\Accounting\AppData\Roaming\calc.ps1" SHA256

Example Output:

SHA256 hash of calc.ps1:

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

CertUtil: -hashfile command completed successfully.

Step 5: Copy and Paste the Hash

Copy theSHA256 hashfrom the output and paste it as required.

Answer:

nginx

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Step 6: Immediate Actions

Terminate the Malicious Process:

powershell

Stop-Process -Name "powershell" -Force

Delete the Malicious File:

powershell

Remove-Item "C:\Users\Accounting\AppData\Roaming\calc.ps1" -Force

Disable Startup Entry:

Check for any persistent scripts:

powershell

Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

Remove any entries related to calc.ps1.

Step 7: Document the Incident

Record the following:

Filename:calc.ps1

File Path:C:\Users\Accounting\AppData\Roaming\

SHA256 Hash:d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Date of Detection:(Today’s date)