81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Sharing

Copy URL Twitter E-mail

General

Target
Debloat-Windows-10-master.zip
Size 29KB
Sample240403-db43tseb49
SHA256 81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a
MD5 ea334594f9de6432712531dc5bbb790d
SHA1 0ea396c39e0ecd96f8acea2cd0c5d232bc0f1137
SHA512 48af80ea25925690bdc21849f068d9e973726de31203c84449c0d286eaebff149d5cce0d254cf47921ad8902ab18134285bce7fbeee57c1b6c8d7f63db50d895
SSDEEP 768:Djw+axvjkRtmV/LdmjseMvoWDjLYRM6sRZ:Ds+axvIkdhReMvo6QM6sn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Debloat-Windows-10-master/lib/New-FolderForced.psm1
- Size 1KB
- SHA256 b903d08563dddab8f1c03f87575972180ebe8a306b48ac7c99d835e47e8ac9fa
- MD5 9e7c82c71e450e991ef7fe382e76cae5
- SHA1 f223d5ef7edcfbebe17164c0974a7e0fc8101b1b
- SHA512 259a14388a916c3aef3d1849471bd18a7c0647066754e748201f9c0554ae00bb024fff09717a153fbbc8b78b056a5eb04795ff78fc101e7df39604a7f26ac211
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Debloat-Windows-10-master/lib/take-own.psm1
- Size 3KB
- SHA256 222d112345466751c72ca535430d139fec72a9afd53fb83286a64ac3a32f0bfa
- MD5 572eece8372d7bdcb3a9bddc9a71acd3
- SHA1 ac544f83a579ed95a36ff2b0b4203ec8e4f11db6
- SHA512 ae1e2c086237ff1f27d82a96b81df289edd63d0a67127df60132344e439d5a95a839de02217c3f41f2f842be17fa7fe700d25617a7b9a0b57dffaa33fc1fc3cd
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  Debloat-Windows-10-master/scripts/block-telemetry.ps1
- Size 8KB
- SHA256 b40f2671440e894f1b2f1bbdeb0c73556363f21d0f081c973828902d00bac487
- MD5 350e535ff63674fe00467498a6cb8af5
- SHA1 ea949080b1f0e650c97da8c165a5da2fbc20f29d
- SHA512 1030b7428490dc447ac9c09539b0b800198773021d6cbbd6f737caab43ec8efead581773f6696424f216e0abcf73a9f969c4899036e081346aa417e0cbaa6a2a
- SSDEEP 192:us8Vn4cehexLYQcyaNICiD71iyBHEeyug:us8VPehab4NICiD78EI9
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10
- Drops file in Drivers directory
behavioral5 behavioral6
- Target
  Debloat-Windows-10-master/scripts/disable-services.ps1
- Size 1KB
- SHA256 b8bd3cb0707b254046435e3351ae9331b6a3b28de1e90ce14a9dd1a3d57b8bdf
- MD5 acca107c6d0ef0b0bfd31aca5927390d
- SHA1 f71d27546e925fa0ee736b9806b82b3c0d83fd13
- SHA512 5b9c0469babe3ff011a30b3d64035c1e0329e2dbcd8f320ab367df0666948f21a29938da35f6c2f9297967742c60c06a673d43d96188fa6dc37ee98bc3ff5979
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  Debloat-Windows-10-master/scripts/disable-windows-defender.ps1
- Size 2KB
- SHA256 27365de295c362797d14cc90311549f5d67f8a76dc981e374648ac51752017b0
- MD5 b745b1a0b4b70e44fac3b25abdb3f63e
- SHA1 ce16a432c63df3be945af976b43a06d5454c3f12
- SHA512 19454c7dfdf1c2fd8aa8a7d1fec9f35e26288e6e36f90d78b4a94759db4fb56f64bc91cc63f1e696bd3c6eb949ffc2733410143184896b46af37da7b7fdbf933
- MD5 SHA1 SHA512
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
behavioral10 behavioral9
- Target
  Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1
- Size 1KB
- SHA256 deec5afd8d537d8744fe8c0c919e53aa32bcf2ba28e60cba03fad2b83a60c506
- MD5 f7d2cfa20e6f94bde9140ac74783a00a
- SHA1 95470cec1299f3409c328c4f3e0e2ade681131a3
- SHA512 df0946065b9a21270ee3bff911fe5e0727fd11116c55936f8ccd5bf68d34f9db05c96ff8ca9190b5f67add42f9584c97bb904231ba66427f188bcc426b8f4024
- MD5 SHA1 SHA512
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1
- Size 7KB
- SHA256 a8e2f1195867da78f0e99d3faf067e773c297ef8e3053344cdf4fcce8b8ca202
- MD5 837f426d2c69aa46f1f5e5781676a382
- SHA1 4b95b9033f5d42050b6033a1bb72869258b4410e
- SHA512 ba760579096849b230cfef799034d965795febc1ccb6ed6c972c10e230b64e06c328ce0b2e7bae2c1b7449782b606a0124778bd66772b403ee4cfb4b6e5c0bb1
- SSDEEP 96:2CrITjTn/7T8dPaFkUuiU0wN3yibEUyibyXYXTJe7TrzMZm0MZm44MZm2MZm95oE:2CcjT3qhbEWbiAYAlJGoqn/inkJAh2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  Debloat-Windows-10-master/scripts/optimize-user-interface.ps1
- Size 7KB
- SHA256 fe15f804a52201685ab5cf0b2243fb96ba0bae7c8e51523cc5acba29fe4df53b
- MD5 e3fc6f833d435f98463d5f8b8a91d9de
- SHA1 405535e4d4808d545bf6a6f9064f6a685582fd9c
- SHA512 93827442a9602d03617b140973a455d7d6b1081f56c1e80b1eecf92a60d1398a658e2c03007762060bae63817314cda8644a624a31760f0d5dfe688b3d9c837a
- SSDEEP 192:xgDCcRewpotyFVPVmH7L//IDcRFBR59S/m+qpVqtl1A:xgDC0edhR5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion
- Modifies visibility of file extensions in Explorer
  evasion
behavioral15 behavioral16
- Target
  Debloat-Windows-10-master/scripts/optimize-windows-update.ps1
- Size 1KB
- SHA256 9c0471f84ca06dcd0b0822e56626f6e8bcf9b0452cc462482e9b39d30bfa873e
- MD5 a43be4706b81313de8611a71ae7d21d4
- SHA1 ceb3abd9ec4e7291d9f1918b5e67735caf1c8089
- SHA512 c0b6382d56f67abd1964679f50fb91a3a05b8145fad6055c4ce09493bffc0e3b8ea9ae839e7b8c2f8cc40ded6c609dadc3e09788dcfadcfdd19fe0bd3f515a36
- MD5 SHA1 SHA512
Score

8^/10

discovery exploit
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
behavioral17 behavioral18
- Target
  Debloat-Windows-10-master/scripts/remove-default-apps.ps1
- Size 5KB
- SHA256 129eb7dea3dc919b0204c7fda510bc8ed6bbb5301725cf67a1b4f25415402fce
- MD5 b7d1027e18e6df11c83b777321ed9247
- SHA1 5b88e48198d679156b65de1b95a07eb59c875910
- SHA512 30e14e09b015851b3de53285de6155785b0fbee0537fbc4a3844a91b8fefa7bcc5f546fa670318152656e3858b29af4a5cf08ea26ee842f7e164d86e5e222a15
- SSDEEP 96:lNrUcT0hNuMIRNabGvB5M25g5F5At5kboNOW6TKQy33JF+4nJvpNLHsVmUO5SYe+:lN4M0VYnWUzQ7mbh4migU2
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  Debloat-Windows-10-master/scripts/remove-onedrive.ps1
- Size 2KB
- SHA256 861391286bc21b91fe404a6d5ed3cb36838daa37d99879d38c97e2c4d7c4b9b8
- MD5 89bb971558db2dea9987d1fa5f5c398e
- SHA1 1ceed67a3f777f755d942cc71e81140a9c6db7e9
- SHA512 2d6010560dc339a569ed2f6832253d464418aef039acd9ec08b9c955da45043821c69643bc403b2201c0c049ef4379c719afa7f807f81a91070570f72026bd41
- MD5 SHA1 SHA512
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Debloat-Windows-10-master/utils/boot-advanced-startup.bat
- Size 35B
- SHA256 a6db677174d9a427e5582db26ec71be1372b3467faca91ff2e082f48ece0db30
- MD5 14b4e3937bbb6560bf853ff651684b67
- SHA1 916231f6c56a7265eabe84d9e7f527f4f564038f
- SHA512 2a51497266d281d5f4b1a9c0fda50a65d83a69856bf5237ee703b63d06ec01ae842fd57d6349ddc62c729956798f84c1dddb8243522ffdf608c5ee57e8b6dacd
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat
- Size 306B
- SHA256 d2997eabf5f11407c5c2312a1e7c2a4d785a9ad0db9a84cedd3fd78864f008df
- MD5 00fe7a3d5531b3d0ae3df2a027d129c8
- SHA1 4cee5b442bbb330f8de04d91940982a55a308b56
- SHA512 036d4881631803f03fb7ac78a8c5f6c0f2701dee6399bea1264dc2805f8b08fce67190c25861434e5dcfb5ca83edbdd5d5d9073f6f252ba2b8e97046221eba63
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  Debloat-Windows-10-master/utils/disable-memory-compression.ps1
- Size 273B
- SHA256 e6195eb532cc9b0fa458228d6c62b727f31a80426d90c8a98c06c3bbabadff75
- MD5 a1d28d2607d52a2efe0e8089602e03fb
- SHA1 40c319de8ea0fa1e8a938056ce130147fff28042
- SHA512 5a234a5cd65e8c8f6b482923a15b91fde3bb455ca262e9be9dec12b957219871446a28636e6cbf1ed304fc5a87d001439360977987243f2cbcae8aaec2fffa62
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1
- Size 352B
- SHA256 750499c4e7ef6eb69e1f6472d74dda0e63dea64cb707d1888ecf3c550950ade7
- MD5 db1f295f9138d6c86b9eba05e1a0dab7
- SHA1 278a3dcc712bba6cbbc07f3cd8c49fd87ee6a779
- SHA512 1e5c94d865040b115b0f16a1e129144935bb4fee614f8923145f238eff86a48a2210be66d8b97db36714b3057ea222bff3d2cce6137f8958b6bfcabe4728a79e
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1
- Size 8KB
- SHA256 596de0bf90b9107738707e92136d7264321f0a6a106575ea2a249fcfcd35c82b
- MD5 acdc5903d0e20c4e60e77a9c5c8da13a
- SHA1 017e620fedb42d4edfdc20f7288348a67b1becf7
- SHA512 978ca4913f4cbe54b96412bef54b053be7e185e712e6c7f634f054366de8f377010ecc729f276c3ad03c98701ada8873025b212f5dac5cd97d0e797b5bf747ee
- SSDEEP 96:DFcgOIdEzoPj1IvvIwKcysSzqIdrIJtI+MW0YfSI1IV6T68+YWTxKcQ6rKYXuF8i:9UKc/k+ORGJIsIj4QnZzzECdq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32