56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 09:35

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
Size 273B
Sample240222-lkbfwafg86
SHA256 e6195eb532cc9b0fa458228d6c62b727f31a80426d90c8a98c06c3bbabadff75
MD5 a1d28d2607d52a2efe0e8089602e03fb
SHA1 40c319de8ea0fa1e8a938056ce130147fff28042
SHA512 5a234a5cd65e8c8f6b482923a15b91fde3bb455ca262e9be9dec12b957219871446a28636e6cbf1ed304fc5a87d001439360977987243f2cbcae8aaec2fffa62
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	powershell.exe
116	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	powershell.exe
Token: SeIncreaseQuotaPrivilege	116	powershell.exe
Token: SeSecurityPrivilege	116	powershell.exe
Token: SeTakeOwnershipPrivilege	116	powershell.exe
Token: SeLoadDriverPrivilege	116	powershell.exe
Token: SeSystemProfilePrivilege	116	powershell.exe
Token: SeSystemtimePrivilege	116	powershell.exe
Token: SeProfSingleProcessPrivilege	116	powershell.exe
Token: SeIncBasePriorityPrivilege	116	powershell.exe
Token: SeCreatePagefilePrivilege	116	powershell.exe
Token: SeBackupPrivilege	116	powershell.exe
Token: SeRestorePrivilege	116	powershell.exe
Token: SeShutdownPrivilege	116	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeSystemEnvironmentPrivilege	116	powershell.exe
Token: SeRemoteShutdownPrivilege	116	powershell.exe
Token: SeUndockPrivilege	116	powershell.exe
Token: SeManageVolumePrivilege	116	powershell.exe
Token: 33	116	powershell.exe
Token: 34	116	powershell.exe
Token: 35	116	powershell.exe
Token: 36	116	powershell.exe

__PSScriptPolicyTest_diraqeaa.pln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_diraqeaa.pln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512