81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/scripts/optimize-user-interface.ps1
Size 7KB
Sample240403-db43tseb49
SHA256 fe15f804a52201685ab5cf0b2243fb96ba0bae7c8e51523cc5acba29fe4df53b
MD5 e3fc6f833d435f98463d5f8b8a91d9de
SHA1 405535e4d4808d545bf6a6f9064f6a685582fd9c
SHA512 93827442a9602d03617b140973a455d7d6b1081f56c1e80b1eecf92a60d1398a658e2c03007762060bae63817314cda8644a624a31760f0d5dfe688b3d9c837a
SSDEEP 192:xgDCcRewpotyFVPVmH7L//IDcRFBR59S/m+qpVqtl1A:xgDC0edhR5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeTakeOwnershipPrivilege	5080	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4000	5080	powershell.exe	89
PID 5080 wrote to memory of 4000	5080	powershell.exe	89
PID 4000 wrote to memory of 3528	4000	csc.exe	91
PID 4000 wrote to memory of 3528	4000	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\optimize-user-interface.ps1
1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3l5splmv\3l5splmv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6726.tmp" "c:\Users\Admin\AppData\Local\Temp\3l5splmv\CSCE88A125DB12C4699888B652CBA24C68F.TMP"
    3⤵
    PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3l5splmv.dll

Path C:\Users\Admin\AppData\Local\Temp\3l5splmv\3l5splmv.dll
Size 4KB
SHA256 b4adbb47754704f5dc13ac5aaec63855e07a310f9042ec50ec591dbbd1cf80c6
MD5 fbb6a041eaf693b473ec76e6ee45d4af
SHA1 eff37511c38e4c465d596a64d041d5ac865c2559
SHA512 4095eaecc998494ca4d57bd32886fc2ac6e4477de1a29d6bf352645eb39553ce0f28562cb0379cf3d81652a1074731be1ca67aa46e1288c2b0736d05cec682c4
MD5 SHA1 SHA512

Submit Download

RES6726.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6726.tmp
Size 1KB
SHA256 761984ef6f94f25bc9f799ccd22d73eea3304d4cfcd9d5afd55fbc1b6da0f310
MD5 48496eafa7261be5a15e5ad889e008da
SHA1 b73c6d20b136bdf3760282c353043a14310d785a
SHA512 e83a0767cae975fd426fb79a1a541a870e218fee12ea919fff3a44749e1a62e9f2a822878d8c6a47196cf309b16fd06ab62c04437520c92bdf0722f0b5041a24
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1q2cg3pz.wrz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1q2cg3pz.wrz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

3l5splmv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3l5splmv\3l5splmv.0.cs
Size 1KB
SHA256 1b91a79cc350ae51efc192bcacfa2d5110d6ea1cecbe911e4f29dccf1c552c23
MD5 db8b1abe547d28cf7dbba64fb49d0c70
SHA1 7d0717c3340dcfc3aaa448f4dd3616eb49c5c1b3
SHA512 a387507dc2ab813e80954c18c08a2c1b3bd2c5fa40bdaa91002b66e03fc734f1ace19a52bfa2b7d994816f78ca4c3e42265c4aecd37323ae878b0c8d73c355cf
MD5 SHA1 SHA512

Submit Download

3l5splmv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3l5splmv\3l5splmv.cmdline
Size 369B
SHA256 33b7884163f48ada12e00388559a2c86d5791e10e48ed822aba1dfa55378c2c3
MD5 11eb3387d5ea4f816ebff03294ae8942
SHA1 3eec223469cc757c07c569fc7d78c60da359c175
SHA512 c75ac2098d55502862fd0f41f18e14673d037655b88c2ed02befb50ea8119e985ccfd8249b6a051b6d4480edcc98b546c9f09291a16297f2022f20e91478b16c
MD5 SHA1 SHA512

Submit Download

CSCE88A125DB12C4699888B652CBA24C68F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3l5splmv\CSCE88A125DB12C4699888B652CBA24C68F.TMP
Size 652B
SHA256 d633ca341abc531ab6020dca64e69ef201010aee1fe0f953457c327b0c39ef69
MD5 0a44d250e7ffe7c9b595b463607af565
SHA1 13009b647d63328e430c4ab2a000009732564bff
SHA512 97f4c025385ba9c11af4e4e80f003088f0408ede65c4ccb0e423abf9c4dd32c4b3ca681468eca18bb646758aa256e2354f55bb161923c8f509e2c5e1332826eb
MD5 SHA1 SHA512

Submit Download

memory/5080-11-0x000001B296E30000-0x000001B296E40000-memory.dmp

Download

memory/5080-15-0x000001B296BE0000-0x000001B296BF0000-memory.dmp

Download

memory/5080-14-0x000001B296BE0000-0x000001B296BF0000-memory.dmp

Download

memory/5080-13-0x00007FFBD65C0000-0x00007FFBD7081000-memory.dmp

Download

memory/5080-12-0x000001B2AF7D0000-0x000001B2AF8D2000-memory.dmp

Download

memory/5080-0-0x000001B2AF220000-0x000001B2AF2A2000-memory.dmp

Download

memory/5080-28-0x000001B2AF190000-0x000001B2AF198000-memory.dmp

Download

memory/5080-10-0x000001B2AF1A0000-0x000001B2AF1C2000-memory.dmp

Download

memory/5080-32-0x00007FFBD65C0000-0x00007FFBD7081000-memory.dmp

Download