56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
Size 8KB
Sample240222-lkbfwafg86
SHA256 3bb5edb9d78c078beb3bbb4595b25ab31d7429d2a1fc3a326e4dad46766d6646
MD5 f5d7bff130264cc2adf16cb9c4da094c
SHA1 1efc2e96e15629f6be1bf1b16a9547b6facd5984
SHA512 a1626b248eccea1240323c95f75fe5de04a7ad8a29332961a7665e5982a6c9f57ad880a5e56ea12bf45a9e5b7a0170ce8279f576e13148021dfbd69c6dfff339
SSDEEP 96:uQVJ738aZ0n4cg/hdAwMtQgrBrTHakx0x2+V76O4BIvXXKCB8lZZFMntqvBqLmmF:us8Vn4cehexLYQcyaNICiD71iyBHEf
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	powershell.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe
Token: SeManageVolumePrivilege	2104	powershell.exe
Token: 33	2104	powershell.exe
Token: 34	2104	powershell.exe
Token: 35	2104	powershell.exe
Token: 36	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe
Token: SeManageVolumePrivilege	2104	powershell.exe
Token: 33	2104	powershell.exe
Token: 34	2104	powershell.exe
Token: 35	2104	powershell.exe
Token: 36	2104	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.ps1"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_flwtxg14.smn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_flwtxg14.smn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 3KB
SHA256 4df502952547c47c328104df001a472ddaa1514d562db3c6d5dad93854aef153
MD5 d1e831dd12c7b042775339d202056b59
SHA1 7ec80387f70a71e178c75da47341b0ec424e64c0
SHA512 f2f8fdfbef54322ef1eea6bff8c2276d2dbb1e8222b105d0deaa763ee272218329b99b40f110afb4cd28ff6814bbe8c53844ade0015493d43c6b75fdaa705ffa
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 6af5a3d8148e4993fb97205d13f8bff383656be5e0c9e86fa109bcfba299f71c
MD5 8b09cce1a05d530d6a6814b355cec4ad
SHA1 cef187e5fac70e7f9ca3cae775b9c69c6ceb8353
SHA512 6cc4108b7634145b02a44ce265ede0e3f976d4e86d0ec11b55f8d0aced0ea3f1c980f35b12108d0c8b557b5ec92ecdbcea3d04127cccf03846c9814a19887260
SSDEEP 96:vDZEurK9DvBCB1/1I6/oMVE47BvfYA1AiHH5XWNfCuDBM//OqBIdhhz5:RrK9zBCB1/154q3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 d0086a6dbd6b91ed91723047274dd70915c3aa0911b2be20307c2ed92f501be3
MD5 639707ef2e1d9e5284cec43c3f733375
SHA1 f33bf7113cedf924b3bb7455c95b71e3eb896d10
SHA512 4ee0661e49dc07917dd825251f70b1f551c3d907d8242df7b0d7530ab483248e882a00143ccd72fa92d970832010da98a8b958f3fbdcd7e1520fc2051d3d3358
MD5 SHA1 SHA512

Submit Download

memory/2104-11-0x000001FF70F50000-0x000001FF70F60000-memory.dmp

Download

memory/2104-12-0x000001FF70F50000-0x000001FF70F60000-memory.dmp

Download

memory/2104-13-0x000001FF70F50000-0x000001FF70F60000-memory.dmp

Download

memory/2104-10-0x00007FF849920000-0x00007FF84A3E1000-memory.dmp

Download

memory/2104-5-0x000001FF71140000-0x000001FF71162000-memory.dmp

Download

memory/2104-309-0x000001FF714C0000-0x000001FF714DA000-memory.dmp

Download

memory/2104-308-0x000001FF71490000-0x000001FF7149E000-memory.dmp

Download

memory/2104-310-0x000001FF70F50000-0x000001FF70F60000-memory.dmp

Download

memory/2104-312-0x00007FF849920000-0x00007FF84A3E1000-memory.dmp

Download