81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1
Size 8KB
Sample240403-db43tseb49
SHA256 596de0bf90b9107738707e92136d7264321f0a6a106575ea2a249fcfcd35c82b
MD5 acdc5903d0e20c4e60e77a9c5c8da13a
SHA1 017e620fedb42d4edfdc20f7288348a67b1becf7
SHA512 978ca4913f4cbe54b96412bef54b053be7e185e712e6c7f634f054366de8f377010ecc729f276c3ad03c98701ada8873025b212f5dac5cd97d0e797b5bf747ee
SSDEEP 96:DFcgOIdEzoPj1IvvIwKcysSzqIdrIJtI+MW0YfSI1IV6T68+YWTxKcQ6rKYXuF8i:9UKc/k+ORGJIsIj4QnZzzECdq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3652	powershell.exe
3652	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeIncreaseQuotaPrivilege	3652	powershell.exe
Token: SeSecurityPrivilege	3652	powershell.exe
Token: SeTakeOwnershipPrivilege	3652	powershell.exe
Token: SeLoadDriverPrivilege	3652	powershell.exe
Token: SeSystemProfilePrivilege	3652	powershell.exe
Token: SeSystemtimePrivilege	3652	powershell.exe
Token: SeProfSingleProcessPrivilege	3652	powershell.exe
Token: SeIncBasePriorityPrivilege	3652	powershell.exe
Token: SeCreatePagefilePrivilege	3652	powershell.exe
Token: SeBackupPrivilege	3652	powershell.exe
Token: SeRestorePrivilege	3652	powershell.exe
Token: SeShutdownPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeSystemEnvironmentPrivilege	3652	powershell.exe
Token: SeRemoteShutdownPrivilege	3652	powershell.exe
Token: SeUndockPrivilege	3652	powershell.exe
Token: SeManageVolumePrivilege	3652	powershell.exe
Token: 33	3652	powershell.exe
Token: 34	3652	powershell.exe
Token: 35	3652	powershell.exe
Token: 36	3652	powershell.exe
Token: SeIncreaseQuotaPrivilege	3652	powershell.exe
Token: SeSecurityPrivilege	3652	powershell.exe
Token: SeTakeOwnershipPrivilege	3652	powershell.exe
Token: SeLoadDriverPrivilege	3652	powershell.exe
Token: SeSystemProfilePrivilege	3652	powershell.exe
Token: SeSystemtimePrivilege	3652	powershell.exe
Token: SeProfSingleProcessPrivilege	3652	powershell.exe
Token: SeIncBasePriorityPrivilege	3652	powershell.exe
Token: SeCreatePagefilePrivilege	3652	powershell.exe
Token: SeBackupPrivilege	3652	powershell.exe
Token: SeRestorePrivilege	3652	powershell.exe
Token: SeShutdownPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeSystemEnvironmentPrivilege	3652	powershell.exe
Token: SeRemoteShutdownPrivilege	3652	powershell.exe
Token: SeUndockPrivilege	3652	powershell.exe
Token: SeManageVolumePrivilege	3652	powershell.exe
Token: 33	3652	powershell.exe
Token: 34	3652	powershell.exe
Token: 35	3652	powershell.exe
Token: 36	3652	powershell.exe
Token: SeIncreaseQuotaPrivilege	3652	powershell.exe
Token: SeSecurityPrivilege	3652	powershell.exe
Token: SeTakeOwnershipPrivilege	3652	powershell.exe
Token: SeLoadDriverPrivilege	3652	powershell.exe
Token: SeSystemProfilePrivilege	3652	powershell.exe
Token: SeSystemtimePrivilege	3652	powershell.exe
Token: SeProfSingleProcessPrivilege	3652	powershell.exe
Token: SeIncBasePriorityPrivilege	3652	powershell.exe
Token: SeCreatePagefilePrivilege	3652	powershell.exe
Token: SeBackupPrivilege	3652	powershell.exe
Token: SeRestorePrivilege	3652	powershell.exe
Token: SeShutdownPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeSystemEnvironmentPrivilege	3652	powershell.exe
Token: SeRemoteShutdownPrivilege	3652	powershell.exe
Token: SeUndockPrivilege	3652	powershell.exe
Token: SeManageVolumePrivilege	3652	powershell.exe
Token: 33	3652	powershell.exe
Token: 34	3652	powershell.exe
Token: 35	3652	powershell.exe
Token: 36	3652	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\utils\disable-scheduled-tasks.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bzyip3gk.1xl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bzyip3gk.1xl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3652-0-0x00000227EBC70000-0x00000227EBCF2000-memory.dmp

Download

memory/3652-11-0x00007FFA3A100000-0x00007FFA3ABC1000-memory.dmp

Download

memory/3652-12-0x00000227E9BF0000-0x00000227E9C00000-memory.dmp

Download

memory/3652-10-0x00000227E94B0000-0x00000227E94C0000-memory.dmp

Download

memory/3652-14-0x00000227E9BF0000-0x00000227E9C00000-memory.dmp

Download

memory/3652-13-0x00000227E9690000-0x00000227E96B2000-memory.dmp

Download

memory/3652-15-0x00000227EBF10000-0x00000227EC012000-memory.dmp

Download

memory/3652-16-0x00000227E9B80000-0x00000227E9BCA000-memory.dmp

Download

memory/3652-17-0x00000227E9BF0000-0x00000227E9C00000-memory.dmp

Download

memory/3652-18-0x00000227EBE00000-0x00000227EBE1E000-memory.dmp

Download

memory/3652-21-0x00007FFA3A100000-0x00007FFA3ABC1000-memory.dmp

Download