Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-es - resource tags
- submitted
03/04/2024, 02:50
General
- Target Debloat-Windows-10-master/lib/New-FolderForced.ps1
- Size 1KB
- Sample240403-db43tseb49
- SHA256 b903d08563dddab8f1c03f87575972180ebe8a306b48ac7c99d835e47e8ac9fa
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\lib\New-FolderForced.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-5-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp
memory/2940-4-0x000000001B710000-0x000000001B9F2000-memory.dmp
memory/2940-7-0x0000000002A80000-0x0000000002B00000-memory.dmp
memory/2940-8-0x00000000023B0000-0x00000000023BE000-memory.dmp
memory/2940-9-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp
memory/2940-10-0x0000000002A80000-0x0000000002B00000-memory.dmp
memory/2940-6-0x0000000002290000-0x0000000002298000-memory.dmp
memory/2940-12-0x0000000002A80000-0x0000000002B00000-memory.dmp
memory/2940-11-0x000000001B610000-0x000000001B656000-memory.dmp
memory/2940-13-0x0000000002A70000-0x0000000002A7A000-memory.dmp
memory/2940-15-0x0000000002A80000-0x0000000002B00000-memory.dmp
memory/2940-16-0x000000001BE10000-0x000000001BE5E000-memory.dmp
memory/2940-17-0x0000000002A80000-0x0000000002B00000-memory.dmp
memory/2940-14-0x0000000002B00000-0x0000000002B08000-memory.dmp
memory/2940-18-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp