Overview
overview
10Static
static
Windows10D...er.zip
windows7-x64
1Windows10D...er.zip
windows10-2004-x64
1Windows10D...rs.ps1
windows7-x64
1Windows10D...rs.ps1
windows10-2004-x64
1Windows10D...ws.ps1
windows7-x64
1Windows10D...ws.ps1
windows10-2004-x64
Windows10D...na.ps1
windows7-x64
1Windows10D...na.ps1
windows10-2004-x64
1Windows10D...ew.ps1
windows7-x64
1Windows10D...ew.ps1
windows10-2004-x64
1Windows10D...na.ps1
windows7-x64
1Windows10D...na.ps1
windows10-2004-x64
1Windows10D...ge PDF
windows7-x64
1Windows10D...ge PDF
windows10-2004-x64
1Windows10D...d Apps
windows7-x64
1Windows10D...d Apps
windows10-2004-x64
1Windows10D...cy.ps1
windows7-x64
1Windows10D...cy.ps1
windows10-2004-x64
1Windows10D...egKeys
windows7-x64
1Windows10D...egKeys
windows10-2004-x64
1Windows10D...es.ps1
windows7-x64
1Windows10D...es.ps1
windows10-2004-x64
1Windows10D...er.ps1
windows7-x64
1Windows10D...er.ps1
windows10-2004-x64
1Windows10D...ge PDF
windows7-x64
1Windows10D...ge PDF
windows10-2004-x64
1Windows10D...ve.ps1
windows7-x64
1Windows10D...ve.ps1
windows10-2004-x64
10Windows10D...rt.ps1
windows7-x64
1Windows10D...rt.ps1
windows10-2004-x64
8Windows10D...ICENSE
windows7-x64
1Windows10D...ICENSE
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 20:15
Static task
static1
Behavioral task
behavioral1
Sample
Windows10Debloater-master.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Windows10Debloater-master.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
Windows10Debloater-master/Individual Scripts/Clear Last Used Files and Folders.ps1
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Windows10Debloater-master/Individual Scripts/Clear Last Used Files and Folders.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Windows10Debloater-master/Individual Scripts/Debloat Windows.ps1
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Windows10Debloater-master/Individual Scripts/Debloat Windows.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Windows10Debloater-master/Individual Scripts/Disable Cortana.ps1
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
Windows10Debloater-master/Individual Scripts/Disable Cortana.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Windows10Debloater-master/Individual Scripts/Disable Last Used Files and Folders View.ps1
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Windows10Debloater-master/Individual Scripts/Disable Last Used Files and Folders View.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Windows10Debloater-master/Individual Scripts/Enable Cortana.ps1
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Windows10Debloater-master/Individual Scripts/Enable Cortana.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Windows10Debloater-master/Individual Scripts/Enable Edge PDF
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Windows10Debloater-master/Individual Scripts/Enable Edge PDF
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Windows10Debloater-master/Individual Scripts/Fix Whitelisted Apps
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
Windows10Debloater-master/Individual Scripts/Fix Whitelisted Apps
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Windows10Debloater-master/Individual Scripts/Protect Privacy.ps1
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Windows10Debloater-master/Individual Scripts/Protect Privacy.ps1
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Windows10Debloater-master/Individual Scripts/Remove Bloatware RegKeys
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Windows10Debloater-master/Individual Scripts/Remove Bloatware RegKeys
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Windows10Debloater-master/Individual Scripts/Revert Changes.ps1
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Windows10Debloater-master/Individual Scripts/Revert Changes.ps1
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
Windows10Debloater-master/Individual Scripts/Set Explorers LaunchTo Computer.ps1
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Windows10Debloater-master/Individual Scripts/Set Explorers LaunchTo Computer.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Windows10Debloater-master/Individual Scripts/Stop Edge PDF
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Windows10Debloater-master/Individual Scripts/Stop Edge PDF
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
Windows10Debloater-master/Individual Scripts/Uninstall OneDrive.ps1
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Windows10Debloater-master/Individual Scripts/Uninstall OneDrive.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
Windows10Debloater-master/Individual Scripts/Unpin Start.ps1
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
Windows10Debloater-master/Individual Scripts/Unpin Start.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Windows10Debloater-master/LICENSE
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
Windows10Debloater-master/LICENSE
Resource
win10v2004-20220812-en
General
-
Target
Windows10Debloater-master/Individual Scripts/Debloat Windows.ps1
-
Size
3KB
-
MD5
fe027363edd3aa71c6a4ae0ecb7ceaae
-
SHA1
2061b9af054ca1f1903797b270439db656d54dff
-
SHA256
2152bdd73176e7152a02b79170fe193e0f036b91373f8781937df67247561de0
-
SHA512
180d0305529edfbe8b18f1627ba3a1212605c703cdd574dfb7dde020209a0fd049effa873aaa9912526501a66ae2fee5d5c9e47aee624b3962d21e6582f105af
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1836 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1836 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Windows10Debloater-master\Individual Scripts\Debloat Windows.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1836-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1836-55-0x000007FEF3BB0000-0x000007FEF45D3000-memory.dmpFilesize
10.1MB
-
memory/1836-57-0x00000000024C4000-0x00000000024C7000-memory.dmpFilesize
12KB
-
memory/1836-56-0x000007FEF3050000-0x000007FEF3BAD000-memory.dmpFilesize
11.4MB
-
memory/1836-58-0x00000000024CB000-0x00000000024EA000-memory.dmpFilesize
124KB
-
memory/1836-60-0x00000000024CB000-0x00000000024EA000-memory.dmpFilesize
124KB
-
memory/1836-59-0x00000000024C4000-0x00000000024C7000-memory.dmpFilesize
12KB