81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1
Size 1KB
Sample240403-db43tseb49
SHA256 deec5afd8d537d8744fe8c0c919e53aa32bcf2ba28e60cba03fad2b83a60c506
MD5 f7d2cfa20e6f94bde9140ac74783a00a
SHA1 95470cec1299f3409c328c4f3e0e2ade681131a3
SHA512 df0946065b9a21270ee3bff911fe5e0727fd11116c55936f8ccd5bf68d34f9db05c96ff8ca9190b5f67add42f9584c97bb904231ba66427f188bcc426b8f4024
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2564	2360	powershell.exe	29
PID 2360 wrote to memory of 2564	2360	powershell.exe	29
PID 2360 wrote to memory of 2564	2360	powershell.exe	29
PID 2360 wrote to memory of 2656	2360	powershell.exe	30
PID 2360 wrote to memory of 2656	2360	powershell.exe	30
PID 2360 wrote to memory of 2656	2360	powershell.exe	30
PID 2360 wrote to memory of 2720	2360	powershell.exe	31
PID 2360 wrote to memory of 2720	2360	powershell.exe	31
PID 2360 wrote to memory of 2720	2360	powershell.exe	31
PID 2360 wrote to memory of 1724	2360	powershell.exe	32
PID 2360 wrote to memory of 1724	2360	powershell.exe	32
PID 2360 wrote to memory of 1724	2360	powershell.exe	32
PID 2360 wrote to memory of 2676	2360	powershell.exe	33
PID 2360 wrote to memory of 2676	2360	powershell.exe	33
PID 2360 wrote to memory of 2676	2360	powershell.exe	33
PID 2360 wrote to memory of 2436	2360	powershell.exe	34
PID 2360 wrote to memory of 2436	2360	powershell.exe	34
PID 2360 wrote to memory of 2436	2360	powershell.exe	34

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\experimental_unfuckery.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2564
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2656
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2720
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:1724
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2676
- C:\Windows\system32\Dism.exe
  "C:\Windows\system32\Dism.exe" /Online /Remove-Package /PackageName: /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 152KB
SHA256 a4649126f3d761873a0bf4a08c624656ba2bb659b13a001e03dfeabe04881f61
MD5 4f1e2df891f80b05a87a0d7823e3aedb
SHA1 652896b562cf04c20370e9756e5f743355c841e2
SHA512 b794e02b77bdf80cd29fe88ade025f93d3bf729f6644f01a4c686590984be705c1b29ca1320f8b1eb5bb42bd2b4aea392ab88ee61821f296d86a0188a9a61db6
SSDEEP 1536:rtRh7frBYF+CV3qF3p0gV5CRGK21iI9h0QXA:ZRhTrBs+Cq/V5CRGK21iIb0QXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 155KB
SHA256 a3f56c5fb4d5dd1e77ecb6a52bfbc54494583be5bcfdc60d9be0f117ba636519
MD5 ee5988d23f069c3f0ca63bb9c5640d47
SHA1 fc6fbe1332176b40b83fb707810ce2d0c6be06a5
SHA512 218ad6138afb0f047ecd283df1631329b193dc7f5595b19cda9d775edc307748c7b852cb5b3854773f568b334657993266abe5597d18f38075bd77186010c5db
SSDEEP 1536:rtRh7frBYF+CV3qF3p0gV5CRGK21iI9h0QXBhX3:ZRhTrBs+Cq/V5CRGK21iIb0QXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 158KB
SHA256 ada6794f202f9e24a7ed874f17eebff6f5f5c3a8f46c577c25b7912ecaace4d5
MD5 9cdd6a38ef5e10b9973f7c676b56969e
SHA1 c8a0163dae8549ff19ed527cd8eae53857e99c35
SHA512 df2a067ddf70e4d6be801a0c065fb547ceb7ff4758fb6afa445ae630fc9f14a8dc69e139c37db1a837601c7792b8529378186c92f54c5cd27e6890f9168fc24b
SSDEEP 1536:rtRh7frBYF+CV3qF3p0gV5CRGK21iI9h0QXBhXp:ZRhTrBs+Cq/V5CRGK21iIb0QXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 162KB
SHA256 59704b18742c0a4321a05c1c79fdcb2cf1632994e206399018892dc7c55c1eb0
MD5 8771196996393a88a9ab7d5522470181
SHA1 bae2e0625297523bac6b966a468fb9990285bbc2
SHA512 3c50c5cf0c5ecc5964d5a5c60884039c42a1a67ecaaade1e0712791b1afdf6bb0d70ae1c08b25be0b6c8d48481f001ad1c30372a09ae020b8d266ef0721fd77d
SSDEEP 1536:rtRh7frBYF+CV3qF3p0gV5CRGK21iI9h0QXBhXA:ZRhTrBs+Cq/V5CRGK21iIb0QX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 165KB
SHA256 61fa10a06a2eee37451f51fc274602179a5cb26ae56dc9ab5fcc551e348bd966
MD5 15582e449ff5b181b44069e5019ddd54
SHA1 725f84289134094cc35a36c10dd35ef62eeb0182
SHA512 e9322dca2694b0683b1aab2e494cc7176564645553383a4c38abfcd76faed66221e63bb846a60f95a14211c92b94afe345382daa000d9ce7114fde00e24ebf96
SSDEEP 1536:rtRh7frBYF+CV3qF3p0gV5CRGK21iI9h0QXBhXN:ZRhTrBs+Cq/V5CRGK21iIb0QXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2360-6-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Download

memory/2360-16-0x000000001BE90000-0x000000001BEDE000-memory.dmp

Download

memory/2360-13-0x0000000002E10000-0x0000000002E1A000-memory.dmp

Download

memory/2360-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2360-11-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2360-14-0x0000000002E20000-0x0000000002E28000-memory.dmp

Download

memory/2360-15-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2360-10-0x000000001B980000-0x000000001B9C6000-memory.dmp

Download

memory/2360-5-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Download

memory/2360-8-0x00000000029F0000-0x00000000029FE000-memory.dmp

Download

memory/2360-9-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Download

memory/2360-7-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2360-4-0x000000001B5B0000-0x000000001B892000-memory.dmp

Download

memory/2360-40-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2360-41-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp

Download