81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Login
Reports

Overview

overview

Static

static

Debloat-Wi...ed.ps1

windows7-x64

Debloat-Wi...ed.ps1

windows10-2004-x64

Debloat-Wi...wn.ps1

windows7-x64

Debloat-Wi...wn.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...es.ps1

windows7-x64

Debloat-Wi...es.ps1

windows10-2004-x64

Debloat-Wi...er.ps1

windows7-x64

Debloat-Wi...er.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...gs.ps1

windows7-x64

Debloat-Wi...gs.ps1

windows10-2004-x64

Debloat-Wi...ce.ps1

windows7-x64

Debloat-Wi...ce.ps1

windows10-2004-x64

Debloat-Wi...te.ps1

windows7-x64

Debloat-Wi...te.ps1

windows10-2004-x64

Debloat-Wi...ps.ps1

windows7-x64

Debloat-Wi...ps.ps1

windows10-2004-x64

Debloat-Wi...ve.ps1

windows7-x64

Debloat-Wi...ve.ps1

windows10-2004-x64

Debloat-Wi...up.bat

windows7-x64

Debloat-Wi...up.bat

windows10-2004-x64

Debloat-Wi...st.bat

windows7-x64

Debloat-Wi...st.bat

windows10-2004-x64

Debloat-Wi...on.ps1

windows7-x64

Debloat-Wi...on.ps1

windows10-2004-x64

Debloat-Wi...ch.ps1

windows7-x64

Debloat-Wi...ch.ps1

windows10-2004-x64

Debloat-Wi...ks.ps1

windows7-x64

Debloat-Wi...ks.ps1

windows10-2004-x64

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win7-20231129-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win7-20231129-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral10

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion trojan

Behavioral task

behavioral11

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win7-20240221-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win10v2004-20240319-es

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral13

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral16

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion

Behavioral task

behavioral17

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win7-20231129-es

windows7-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral18

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral19

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral21

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win7-20240221-es

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

17 signatures

150 seconds

persistence

Behavioral task

behavioral23

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win7-20240221-es

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win7-20240319-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target
Debloat-Windows-10-master/utils/boot-advanced-startup.bat
Size 35B
Sample240403-db43tseb49
SHA256 a6db677174d9a427e5582db26ec71be1372b3467faca91ff2e082f48ece0db30
MD5 14b4e3937bbb6560bf853ff651684b67
SHA1 916231f6c56a7265eabe84d9e7f527f4f564038f
SHA512 2a51497266d281d5f4b1a9c0fda50a65d83a69856bf5237ee703b63d06ec01ae842fd57d6349ddc62c729956798f84c1dddb8243522ffdf608c5ee57e8b6dacd
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2880	2832	cmd.exe	29
PID 2832 wrote to memory of 2880	2832	cmd.exe	29
PID 2832 wrote to memory of 2880	2832	cmd.exe	29

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\utils\boot-advanced-startup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\shutdown.exe
  shutdown /o /r /t 00
  2⤵
  PID:2880

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads