81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Login
Reports

Overview

overview

Static

static

Debloat-Wi...ed.ps1

windows7-x64

Debloat-Wi...ed.ps1

windows10-2004-x64

Debloat-Wi...wn.ps1

windows7-x64

Debloat-Wi...wn.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...es.ps1

windows7-x64

Debloat-Wi...es.ps1

windows10-2004-x64

Debloat-Wi...er.ps1

windows7-x64

Debloat-Wi...er.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...gs.ps1

windows7-x64

Debloat-Wi...gs.ps1

windows10-2004-x64

Debloat-Wi...ce.ps1

windows7-x64

Debloat-Wi...ce.ps1

windows10-2004-x64

Debloat-Wi...te.ps1

windows7-x64

Debloat-Wi...te.ps1

windows10-2004-x64

Debloat-Wi...ps.ps1

windows7-x64

Debloat-Wi...ps.ps1

windows10-2004-x64

Debloat-Wi...ve.ps1

windows7-x64

Debloat-Wi...ve.ps1

windows10-2004-x64

Debloat-Wi...up.bat

windows7-x64

Debloat-Wi...up.bat

windows10-2004-x64

Debloat-Wi...st.bat

windows7-x64

Debloat-Wi...st.bat

windows10-2004-x64

Debloat-Wi...on.ps1

windows7-x64

Debloat-Wi...on.ps1

windows10-2004-x64

Debloat-Wi...ch.ps1

windows7-x64

Debloat-Wi...ch.ps1

windows10-2004-x64

Debloat-Wi...ks.ps1

windows7-x64

Debloat-Wi...ks.ps1

windows10-2004-x64

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win7-20231129-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win7-20231129-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral10

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion trojan

Behavioral task

behavioral11

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win7-20240221-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win10v2004-20240319-es

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral13

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral16

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion

Behavioral task

behavioral17

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win7-20231129-es

windows7-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral18

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral19

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral21

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win7-20240221-es

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

17 signatures

150 seconds

persistence

Behavioral task

behavioral23

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win7-20240221-es

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win7-20240319-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target
Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat
Size 306B
Sample240403-db43tseb49
SHA256 d2997eabf5f11407c5c2312a1e7c2a4d785a9ad0db9a84cedd3fd78864f008df
MD5 00fe7a3d5531b3d0ae3df2a027d129c8
SHA1 4cee5b442bbb330f8de04d91940982a55a308b56
SHA512 036d4881631803f03fb7ac78a8c5f6c0f2701dee6399bea1264dc2805f8b08fce67190c25861434e5dcfb5ca83edbdd5d5d9073f6f252ba2b8e97046221eba63
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
2324	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2324	2344	cmd.exe	29
PID 2344 wrote to memory of 2324	2344	cmd.exe	29
PID 2344 wrote to memory of 2324	2344	cmd.exe	29

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\utils\disable-ShellExperienceHost.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ShellExperienceHost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2324

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads