56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
Size 8KB
Sample240222-lkbfwafg86
SHA256 596de0bf90b9107738707e92136d7264321f0a6a106575ea2a249fcfcd35c82b
MD5 acdc5903d0e20c4e60e77a9c5c8da13a
SHA1 017e620fedb42d4edfdc20f7288348a67b1becf7
SHA512 978ca4913f4cbe54b96412bef54b053be7e185e712e6c7f634f054366de8f377010ecc729f276c3ad03c98701ada8873025b212f5dac5cd97d0e797b5bf747ee
SSDEEP 96:DFcgOIdEzoPj1IvvIwKcysSzqIdrIJtI+MW0YfSI1IV6T68+YWTxKcQ6rKYXuF8i:9UKc/k+ORGJIsIj4QnZzzECdq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	powershell.exe
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tawcvfn0.rme.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tawcvfn0.rme.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1624-0-0x000002617A6A0000-0x000002617A6C2000-memory.dmp

Download

memory/1624-10-0x00007FFCC4B40000-0x00007FFCC5601000-memory.dmp

Download

memory/1624-11-0x0000026178520000-0x0000026178530000-memory.dmp

Download

memory/1624-12-0x0000026178520000-0x0000026178530000-memory.dmp

Download

memory/1624-13-0x0000026178520000-0x0000026178530000-memory.dmp

Download

memory/1624-14-0x0000026178520000-0x0000026178530000-memory.dmp

Download

memory/1624-16-0x00007FFCC4B40000-0x00007FFCC5601000-memory.dmp

Download