Analysis
- max time kernel
119s - max time network
132s - platform
windows7_x64 - resource
win7-20240221-es - resource tags
- submitted
03/04/2024, 02:50
General
- Target Debloat-Windows-10-master/scripts/optimize-user-interface.ps1
- Size 7KB
- Sample240403-db43tseb49
- SHA256 fe15f804a52201685ab5cf0b2243fb96ba0bae7c8e51523cc5acba29fe4df53b
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\optimize-user-interface.ps11⤵
- Modifies visibility of file extensions in Explorer
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2972-4-0x000000001B300000-0x000000001B5E2000-memory.dmp
memory/2972-5-0x00000000024B0000-0x00000000024B8000-memory.dmp
memory/2972-6-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp
memory/2972-8-0x00000000029A0000-0x0000000002A20000-memory.dmp
memory/2972-10-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp
memory/2972-11-0x00000000029A0000-0x0000000002A20000-memory.dmp
memory/2972-13-0x00000000029A0000-0x0000000002A20000-memory.dmp
memory/2972-14-0x0000000002950000-0x0000000002958000-memory.dmp
memory/2972-12-0x0000000002940000-0x000000000294A000-memory.dmp
memory/2972-9-0x000000001B640000-0x000000001B686000-memory.dmp
memory/2972-7-0x0000000002720000-0x000000000272E000-memory.dmp
memory/2972-16-0x000000001BA90000-0x000000001BADE000-memory.dmp
memory/2972-15-0x00000000029A0000-0x0000000002A20000-memory.dmp
memory/2972-17-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp