Overview
overview
10Static
static
10Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10data/plugi...Ve.dll
windows7-x64
1data/plugi...Ve.dll
windows10-2004-x64
1data/plugi...ff.bat
windows7-x64
1data/plugi...ff.bat
windows10-2004-x64
1data/plugi...on.bat
windows7-x64
1data/plugi...on.bat
windows10-2004-x64
1data/plugi...ff.bat
windows7-x64
1data/plugi...ff.bat
windows10-2004-x64
1data/plugi...on.bat
windows7-x64
1data/plugi...on.bat
windows10-2004-x64
1data/scrip...de.ps1
windows7-x64
1data/scrip...de.ps1
windows10-2004-x64
1data/scrip...ps.ps1
windows7-x64
1data/scrip...ps.ps1
windows10-2004-x64
1data/scrip...ps.ps1
windows7-x64
1data/scrip...ps.ps1
windows10-2004-x64
1data/scrip...ve.ps1
windows7-x64
1data/scrip...ve.ps1
windows10-2004-x64
10data/scrip...d).ps1
windows7-x64
1data/scrip...d).ps1
windows10-2004-x64
8data/scrip...d).ps1
windows7-x64
1data/scrip...d).ps1
windows10-2004-x64
1data/scrip...ps.ps1
windows7-x64
1data/scrip...ps.ps1
windows10-2004-x64
1data/scrip...es.ps1
windows7-x64
8data/scrip...es.ps1
windows10-2004-x64
8data/scrip...ct.ps1
windows7-x64
1data/scrip...ct.ps1
windows10-2004-x64
8data/scrip...de.ps1
windows7-x64
1data/scrip...de.ps1
windows10-2004-x64
1Analysis
-
max time kernel
39s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-01-2023 17:32
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
data/plugins/Albacore.ViVe.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
data/plugins/Albacore.ViVe.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
data/plugins/aal_off.bat
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
data/plugins/aal_off.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
data/plugins/aal_on.bat
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
data/plugins/aal_on.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
data/plugins/tpm_off.bat
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
data/plugins/tpm_off.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
data/plugins/tpm_on.bat
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
data/plugins/tpm_on.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
data/scripts/Apps/Enable apps dark mode.ps1
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
data/scripts/Apps/Enable apps dark mode.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
data/scripts/Apps/Install apps.ps1
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
data/scripts/Apps/Install apps.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
data/scripts/Apps/Reinstall all built-in apps.ps1
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
data/scripts/Apps/Reinstall all built-in apps.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
data/scripts/Apps/Remove OneDrive.ps1
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
data/scripts/Apps/Remove OneDrive.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
data/scripts/Apps/Remove default apps (Provisioned).ps1
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
data/scripts/Apps/Remove default apps (Provisioned).ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
data/scripts/Apps/Remove default apps (Recommended).ps1
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
data/scripts/Apps/Remove default apps (Recommended).ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
data/scripts/Apps/Update Store apps.ps1
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
data/scripts/Apps/Update Store apps.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
data/scripts/Edge/Bypass Edge as default handler for web searches.ps1
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
data/scripts/Edge/Bypass Edge as default handler for web searches.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
data/scripts/Edge/Run MSEdgeRedirect.ps1
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
data/scripts/Edge/Run MSEdgeRedirect.ps1
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
data/scripts/Energy/Ultimate Performance mode.ps1
Resource
win7-20221111-en
Behavioral task
behavioral32
Sample
data/scripts/Energy/Ultimate Performance mode.ps1
Resource
win10v2004-20220812-en
General
-
Target
data/scripts/Apps/Update Store apps.ps1
-
Size
306B
-
MD5
b0956f3ca1276f88a8f2246c898709a8
-
SHA1
4f32b0e3aab2007c4af64e72cc51c35ea73b6e37
-
SHA256
b0d81c299986e4b1ee94ae08cff05f370a8b07bfb43a5d89585d13b2307c3521
-
SHA512
9fbc756c1d15f529a53202a4c4ebef249cf0e9e89be90f69b4fadc364444679ab6e876f1a3e7b3e3134ae0e3459aaafba457b12cc0d49690a90016cf21e562bd
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 884 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 884 powershell.exe