56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
Size 1KB
Sample240222-lkbfwafg86
SHA256 deec5afd8d537d8744fe8c0c919e53aa32bcf2ba28e60cba03fad2b83a60c506
MD5 f7d2cfa20e6f94bde9140ac74783a00a
SHA1 95470cec1299f3409c328c4f3e0e2ade681131a3
SHA512 df0946065b9a21270ee3bff911fe5e0727fd11116c55936f8ccd5bf68d34f9db05c96ff8ca9190b5f67add42f9584c97bb904231ba66427f188bcc426b8f4024
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2508	2216	powershell.exe	29
PID 2216 wrote to memory of 2508	2216	powershell.exe	29
PID 2216 wrote to memory of 2508	2216	powershell.exe	29
PID 2216 wrote to memory of 2844	2216	powershell.exe	30
PID 2216 wrote to memory of 2844	2216	powershell.exe	30
PID 2216 wrote to memory of 2844	2216	powershell.exe	30
PID 2216 wrote to memory of 2832	2216	powershell.exe	31
PID 2216 wrote to memory of 2832	2216	powershell.exe	31
PID 2216 wrote to memory of 2832	2216	powershell.exe	31
PID 2216 wrote to memory of 2776	2216	powershell.exe	32
PID 2216 wrote to memory of 2776	2216	powershell.exe	32
PID 2216 wrote to memory of 2776	2216	powershell.exe	32
PID 2216 wrote to memory of 2568	2216	powershell.exe	33
PID 2216 wrote to memory of 2568	2216	powershell.exe	33
PID 2216 wrote to memory of 2568	2216	powershell.exe	33
PID 2216 wrote to memory of 2400	2216	powershell.exe	34
PID 2216 wrote to memory of 2400	2216	powershell.exe	34
PID 2216 wrote to memory of 2400	2216	powershell.exe	34

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2508
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2844
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2832
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2776
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2568
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 152KB
SHA256 e18b32ce22afea11f392ba29010032ea8e74c6ca271dd2c72f0d91b9aa792b64
MD5 76eb196ac15eb23ccd1b0bb0e10ba860
SHA1 86b0c10e7bab7e6f1966f5afcd65f005b8b9bf6c
SHA512 06d243b7900eeb543ec495ba2029fb93980014da62304c6b824e1d18cd92ff38a895b960a5757fcdad12b455e68505f29c747853b03f0d0b6e359f6809ba08c6
SSDEEP 768:Ms8sfsLPsZb23ifOgH+eklq48cab/hmRhSzhhK9aR0OsfExXwCilgqilmwrri+No:MnmiPQp43gQFwfiSnI0aim5pEIKi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 155KB
SHA256 706bb91b736b8228ebc505b750e92faa77a1844e1456b7e4d45b36c13cdca928
MD5 98bd35d6f0b792704ad0b18c9a609c2f
SHA1 b8f475714a876666728831328994158edef4e9b1
SHA512 b07f6c11424475c42d89edae0cafa8e704be76c581412d8960d258d9ac99e1df2180519ef5ad5378f8feb5eddf383345b3b27e69f975dba8a61dae189ef0b98f
SSDEEP 768:Ms8sfsLPsZb23ifOgH+eklq48cab/hmRhSzhhK9aR0OsfExXwCilgqilmwrri+NZ:MnmiPQp43gQFwfiSnI0aim5pEIKiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 158KB
SHA256 62430eb608d73e61dfb1e94fe6ec7b142903b94c781630897a52db88fa0fca48
MD5 00a05a743b93d7ac46ddadc054e42673
SHA1 4dda682b8dbc9ed3e0a5dc176758cc61467907b0
SHA512 3898d031538c6780c7972876017a95e2cf0cdeb28ac4d31db845b38d900cba2ba317c5a4a20c05bb66c742240d9a1d6f5f59badf67c04adc586955c4b19993bc
SSDEEP 768:Ms8sfsLPsZb23ifOgH+eklq48cab/hmRhSzhhK9aR0OsfExXwCilgqilmwrri+NX:MnmiPQp43gQFwfiSnI0aim5pEIKiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 162KB
SHA256 a1190ad2c882cde4b233cd3e699a41c21d3fbcb8643155d95422659af21f75e8
MD5 45be6339e4092946c98d09b62020f67b
SHA1 561f35381eca17a2d7f7668fa575e04f9e8bbc40
SHA512 457777cda367f9cbfac1199e1f3871f88eb09913ee8d33ce021c52d85ab2533902d4b799f52b10f7acee449ae5c22c6fca038a62d8b68d41e2439b16ce875d19
SSDEEP 768:Ms8sfsLPsZb23ifOgH+eklq48cab/hmRhSzhhK9aR0OsfExXwCilgqilmwrri+Nk:MnmiPQp43gQFwfiSnI0aim5pEIKij
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 165KB
SHA256 bea184bee991168132424c757e208ef473680da14e25c799199b6480a6c40adf
MD5 f981f34f72f45c090850f3db1a92c2db
SHA1 209bcfa0531509b52b9fc67de4bed2ac6e8ee8d7
SHA512 c282a9d4b48a58b55c01f625db71406931d6ecb6c8313f1b5b1375266cf2d8605d56b856c5e59a6983645de0a4e53f99151f1cefb58e8bd71cd5c390799f09af
SSDEEP 768:Ms8sfsLPsZb23ifOgH+eklq48cab/hmRhSzhhK9aR0OsfExXwCilgqilmwrri+Nc:MnmiPQp43gQFwfiSnI0aim5pEIKiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2216-7-0x0000000002290000-0x0000000002310000-memory.dmp

Download

memory/2216-10-0x0000000002290000-0x0000000002310000-memory.dmp

Download

memory/2216-9-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Download

memory/2216-8-0x0000000002290000-0x0000000002310000-memory.dmp

Download

memory/2216-4-0x000000001B390000-0x000000001B672000-memory.dmp

Download

memory/2216-6-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Download

memory/2216-5-0x0000000002510000-0x0000000002518000-memory.dmp

Download

memory/2216-34-0x0000000002290000-0x0000000002310000-memory.dmp

Download

memory/2216-35-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Download