56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
128s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
Size 2KB
Sample240222-lkbfwafg86
SHA256 861391286bc21b91fe404a6d5ed3cb36838daa37d99879d38c97e2c4d7c4b9b8
MD5 89bb971558db2dea9987d1fa5f5c398e
SHA1 1ceed67a3f777f755d942cc71e81140a9c6db7e9
SHA512 2d6010560dc339a569ed2f6832253d464418aef039acd9ec08b9c955da45043821c69643bc403b2201c0c049ef4379c719afa7f807f81a91070570f72026bd41
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2072	taskkill.exe
2512	taskkill.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\Default	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	explorer.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeRestorePrivilege	2552	reg.exe
Token: SeRestorePrivilege	2540	reg.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe
Token: SeShutdownPrivilege	2652	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe
2652	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2072	2824	powershell.exe	29
PID 2824 wrote to memory of 2072	2824	powershell.exe	29
PID 2824 wrote to memory of 2072	2824	powershell.exe	29
PID 2824 wrote to memory of 2512	2824	powershell.exe	31
PID 2824 wrote to memory of 2512	2824	powershell.exe	31
PID 2824 wrote to memory of 2512	2824	powershell.exe	31
PID 2824 wrote to memory of 2552	2824	powershell.exe	34
PID 2824 wrote to memory of 2552	2824	powershell.exe	34
PID 2824 wrote to memory of 2552	2824	powershell.exe	34
PID 2824 wrote to memory of 2720	2824	powershell.exe	33
PID 2824 wrote to memory of 2720	2824	powershell.exe	33
PID 2824 wrote to memory of 2720	2824	powershell.exe	33
PID 2824 wrote to memory of 2540	2824	powershell.exe	32
PID 2824 wrote to memory of 2540	2824	powershell.exe	32
PID 2824 wrote to memory of 2540	2824	powershell.exe	32
PID 2824 wrote to memory of 2652	2824	powershell.exe	35
PID 2824 wrote to memory of 2652	2824	powershell.exe	35
PID 2824 wrote to memory of 2652	2824	powershell.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.ps1"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /F /IM OneDrive.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" unload hku\Default
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" load hku\Default C:\Users\Default\NTUSER.DAT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-13-0x00000000044D0000-0x00000000044D1000-memory.dmp

Download

memory/2652-19-0x0000000002640000-0x0000000002650000-memory.dmp

Download

memory/2652-15-0x00000000044D0000-0x00000000044D1000-memory.dmp

Download

memory/2824-7-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Download

memory/2824-8-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Download

memory/2824-9-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Download

memory/2824-10-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Download

memory/2824-11-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Download

memory/2824-12-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Download

memory/2824-4-0x000000001B420000-0x000000001B702000-memory.dmp

Download

memory/2824-14-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Download

memory/2824-5-0x0000000002170000-0x0000000002178000-memory.dmp

Download

memory/2824-6-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Download