81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Login
Reports

Overview

overview

Static

static

Debloat-Wi...ed.ps1

windows7-x64

Debloat-Wi...ed.ps1

windows10-2004-x64

Debloat-Wi...wn.ps1

windows7-x64

Debloat-Wi...wn.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...es.ps1

windows7-x64

Debloat-Wi...es.ps1

windows10-2004-x64

Debloat-Wi...er.ps1

windows7-x64

Debloat-Wi...er.ps1

windows10-2004-x64

Debloat-Wi...ry.ps1

windows7-x64

Debloat-Wi...ry.ps1

windows10-2004-x64

Debloat-Wi...gs.ps1

windows7-x64

Debloat-Wi...gs.ps1

windows10-2004-x64

Debloat-Wi...ce.ps1

windows7-x64

Debloat-Wi...ce.ps1

windows10-2004-x64

Debloat-Wi...te.ps1

windows7-x64

Debloat-Wi...te.ps1

windows10-2004-x64

Debloat-Wi...ps.ps1

windows7-x64

Debloat-Wi...ps.ps1

windows10-2004-x64

Debloat-Wi...ve.ps1

windows7-x64

Debloat-Wi...ve.ps1

windows10-2004-x64

Debloat-Wi...up.bat

windows7-x64

Debloat-Wi...up.bat

windows10-2004-x64

Debloat-Wi...st.bat

windows7-x64

Debloat-Wi...st.bat

windows10-2004-x64

Debloat-Wi...on.ps1

windows7-x64

Debloat-Wi...on.ps1

windows10-2004-x64

Debloat-Wi...ch.ps1

windows7-x64

Debloat-Wi...ch.ps1

windows10-2004-x64

Debloat-Wi...ks.ps1

windows7-x64

Debloat-Wi...ks.ps1

windows10-2004-x64

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win7-20231129-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Debloat-Windows-10-master/lib/New-FolderForced.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Debloat-Windows-10-master/lib/take-own.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Debloat-Windows-10-master/scripts/block-telemetry.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

Debloat-Windows-10-master/scripts/disable-services.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win7-20231129-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral10

Sample

Debloat-Windows-10-master/scripts/disable-windows-defender.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion trojan

Behavioral task

behavioral11

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win7-20240221-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1

Resource

win10v2004-20240319-es

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral13

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

evasion

Behavioral task

behavioral16

Sample

Debloat-Windows-10-master/scripts/optimize-user-interface.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

evasion

Behavioral task

behavioral17

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win7-20231129-es

windows7-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral18

Sample

Debloat-Windows-10-master/scripts/optimize-windows-update.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

5 signatures

150 seconds

discovery exploit

Behavioral task

behavioral19

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

Debloat-Windows-10-master/scripts/remove-default-apps.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral21

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win7-20240221-es

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Debloat-Windows-10-master/scripts/remove-onedrive.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

17 signatures

150 seconds

persistence

Behavioral task

behavioral23

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win7-20240221-es

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Debloat-Windows-10-master/utils/boot-advanced-startup.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win7-20240221-es

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat

Resource

win10v2004-20240226-es

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win7-20240221-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Debloat-Windows-10-master/utils/disable-memory-compression.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win7-20240319-es

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win7-20240220-es

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1

Resource

win10v2004-20240226-es

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target
Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat
Size 306B
Sample240403-db43tseb49
SHA256 d2997eabf5f11407c5c2312a1e7c2a4d785a9ad0db9a84cedd3fd78864f008df
MD5 00fe7a3d5531b3d0ae3df2a027d129c8
SHA1 4cee5b442bbb330f8de04d91940982a55a308b56
SHA512 036d4881631803f03fb7ac78a8c5f6c0f2701dee6399bea1264dc2805f8b08fce67190c25861434e5dcfb5ca83edbdd5d5d9073f6f252ba2b8e97046221eba63
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
2620	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2620	3652	cmd.exe	87
PID 3652 wrote to memory of 2620	3652	cmd.exe	87

Processes

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\utils\disable-ShellExperienceHost.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ShellExperienceHost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads