81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/utils/disable-memory-compression.ps1
Size 273B
Sample240403-db43tseb49
SHA256 e6195eb532cc9b0fa458228d6c62b727f31a80426d90c8a98c06c3bbabadff75
MD5 a1d28d2607d52a2efe0e8089602e03fb
SHA1 40c319de8ea0fa1e8a938056ce130147fff28042
SHA512 5a234a5cd65e8c8f6b482923a15b91fde3bb455ca262e9be9dec12b957219871446a28636e6cbf1ed304fc5a87d001439360977987243f2cbcae8aaec2fffa62
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	powershell.exe
748	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	powershell.exe
Token: SeIncreaseQuotaPrivilege	748	powershell.exe
Token: SeSecurityPrivilege	748	powershell.exe
Token: SeTakeOwnershipPrivilege	748	powershell.exe
Token: SeLoadDriverPrivilege	748	powershell.exe
Token: SeSystemProfilePrivilege	748	powershell.exe
Token: SeSystemtimePrivilege	748	powershell.exe
Token: SeProfSingleProcessPrivilege	748	powershell.exe
Token: SeIncBasePriorityPrivilege	748	powershell.exe
Token: SeCreatePagefilePrivilege	748	powershell.exe
Token: SeBackupPrivilege	748	powershell.exe
Token: SeRestorePrivilege	748	powershell.exe
Token: SeShutdownPrivilege	748	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeSystemEnvironmentPrivilege	748	powershell.exe
Token: SeRemoteShutdownPrivilege	748	powershell.exe
Token: SeUndockPrivilege	748	powershell.exe
Token: SeManageVolumePrivilege	748	powershell.exe
Token: 33	748	powershell.exe
Token: 34	748	powershell.exe
Token: 35	748	powershell.exe
Token: 36	748	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\utils\disable-memory-compression.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1336 --field-trial-handle=2236,i,9620146984988173115,9029267257062987797,262144 --variations-seed-version /prefetch:8
1⤵
PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_xpzk13mk.bdy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpzk13mk.bdy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/748-14-0x00000218EDE90000-0x00000218EDEA0000-memory.dmp

Download

memory/748-1-0x00000218EDF00000-0x00000218EDF22000-memory.dmp

Download

memory/748-11-0x00000218EDEE0000-0x00000218EDEF0000-memory.dmp

Download

memory/748-12-0x00007FF97D980000-0x00007FF97E441000-memory.dmp

Download

memory/748-13-0x00000218EDE90000-0x00000218EDEA0000-memory.dmp

Download

memory/748-0-0x00000218F0660000-0x00000218F06E2000-memory.dmp

Download

memory/748-15-0x00000218EDE90000-0x00000218EDEA0000-memory.dmp

Download

memory/748-16-0x00000218F0900000-0x00000218F0A02000-memory.dmp

Download

memory/748-17-0x00000218F0840000-0x00000218F088A000-memory.dmp

Download

memory/748-18-0x00000218F0820000-0x00000218F083E000-memory.dmp

Download

memory/748-19-0x00000218EDE90000-0x00000218EDEA0000-memory.dmp

Download

memory/748-22-0x00007FF97D980000-0x00007FF97E441000-memory.dmp

Download