81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
114s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1
Size 7KB
Sample240403-db43tseb49
SHA256 a8e2f1195867da78f0e99d3faf067e773c297ef8e3053344cdf4fcce8b8ca202
MD5 837f426d2c69aa46f1f5e5781676a382
SHA1 4b95b9033f5d42050b6033a1bb72869258b4410e
SHA512 ba760579096849b230cfef799034d965795febc1ccb6ed6c972c10e230b64e06c328ce0b2e7bae2c1b7449782b606a0124778bd66772b403ee4cfb4b6e5c0bb1
SSDEEP 96:2CrITjTn/7T8dPaFkUuiU0wN3yibEUyibyXYXTJe7TrzMZm0MZm44MZm2MZm95oE:2CcjT3qhbEWbiAYAlJGoqn/inkJAh2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\User\Default\SearchScopes	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\User\Default	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DoNotTrack = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\User\Default\SearchScopes\ShowSearchSuggestionsGlobal = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FPEnabled = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\User	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeTakeOwnershipPrivilege	4664	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3792	4664	powershell.exe	95
PID 4664 wrote to memory of 3792	4664	powershell.exe	95
PID 3792 wrote to memory of 1980	3792	csc.exe	97
PID 3792 wrote to memory of 1980	3792	csc.exe	97

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\fix-privacy-settings.ps1
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gu1rrpt4\gu1rrpt4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7985.tmp" "c:\Users\Admin\AppData\Local\Temp\gu1rrpt4\CSC5FD54AD2546D4C2883BFC43C98961BCB.TMP"
    3⤵
    PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1048 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:8
1⤵
PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES7985.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7985.tmp
Size 1KB
SHA256 cad9fea33b86c252679f778ff51ab9830bea9858dcc9b236524d106ed1f5e249
MD5 099794594cb467ef63120f920dc0d7dd
SHA1 093abf67eb2a0f455232f749633136d6936b5573
SHA512 05c3762866243aa23235c851f50d3bfc75a335e93b127b49c562ab6d8edd0bd68f805b6d337843bc46ba322984ffe0ca5c94ab63701321e57b1d7a1b2357b2d6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_janwmjmj.bg0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_janwmjmj.bg0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gu1rrpt4.dll

Path C:\Users\Admin\AppData\Local\Temp\gu1rrpt4\gu1rrpt4.dll
Size 4KB
SHA256 94eff7ce3af68456d94afb5851b14d4bf77b5cd07f90e87681e02430752d2205
MD5 e6d0262b0a33b2270cb4d85f2e3e8fd7
SHA1 36f5d2ae877c01d9eef864776500267512121844
SHA512 01785c57fbe7772358c6226b0bcc093acf0a14e08ade6451b778c05770bcdc97c6a7d1a696a903c84d2356a68ba204d9feebd03e101565b015150e3614b57669
MD5 SHA1 SHA512

Submit Download

CSC5FD54AD2546D4C2883BFC43C98961BCB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gu1rrpt4\CSC5FD54AD2546D4C2883BFC43C98961BCB.TMP
Size 652B
SHA256 65a54a74a24e2a8cb73291ec0ee5d3c981767ea8d9d5c67bc67f29053d6d4101
MD5 12bf115a2e4e0270f03d7f3c83f931ce
SHA1 b076fb6dedfdceb7980b0ec3e6d365ef61bfca6d
SHA512 698eb82a5588cfad50f608d47ae2f27b8e5c3ffe26d8a52c6ebc046b957e4157b9827542a7db681796aff6196a6d4bf9ac008c56ace20fc70e1c0c915c94b288
MD5 SHA1 SHA512

Submit Download

gu1rrpt4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gu1rrpt4\gu1rrpt4.0.cs
Size 1KB
SHA256 1b91a79cc350ae51efc192bcacfa2d5110d6ea1cecbe911e4f29dccf1c552c23
MD5 db8b1abe547d28cf7dbba64fb49d0c70
SHA1 7d0717c3340dcfc3aaa448f4dd3616eb49c5c1b3
SHA512 a387507dc2ab813e80954c18c08a2c1b3bd2c5fa40bdaa91002b66e03fc734f1ace19a52bfa2b7d994816f78ca4c3e42265c4aecd37323ae878b0c8d73c355cf
MD5 SHA1 SHA512

Submit Download

gu1rrpt4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gu1rrpt4\gu1rrpt4.cmdline
Size 369B
SHA256 56402ae8592b7204e6804187e21b3e1203cb3c5b9c0bf0c3119f36d29d9eb26b
MD5 9324bbf031df3d0900a5f6281dfe4332
SHA1 fbbc808fd954ddad20150dea423bf88e762407cd
SHA512 9404662e712fe0b7fd270ec76ce0350e278898dd2eccfe0847270908587abe4c4e605270777be1a4e622cc8c8d9b2ee6211cf7def3a608c77eec35bcd8710b1d
MD5 SHA1 SHA512

Submit Download

memory/4664-8-0x000001F1E36C0000-0x000001F1E36D0000-memory.dmp

Download

memory/4664-15-0x000001F1E3C70000-0x000001F1E3D72000-memory.dmp

Download

memory/4664-14-0x000001F1C99B0000-0x000001F1C99C0000-memory.dmp

Download

memory/4664-9-0x000001F1E36C0000-0x000001F1E36D0000-memory.dmp

Download

memory/4664-0-0x000001F1E3930000-0x000001F1E39B2000-memory.dmp

Download

memory/4664-28-0x000001F1CB320000-0x000001F1CB328000-memory.dmp

Download

memory/4664-30-0x000001F1E38E0000-0x000001F1E38EA000-memory.dmp

Download

memory/4664-7-0x00007FFBD38E0000-0x00007FFBD43A1000-memory.dmp

Download

memory/4664-6-0x000001F1CB2F0000-0x000001F1CB312000-memory.dmp

Download

memory/4664-33-0x00007FFBD38E0000-0x00007FFBD43A1000-memory.dmp

Download