Overview
overview
10Static
static
1Debloat-Wi...ed.ps1
windows7-x64
1Debloat-Wi...ed.ps1
windows10-2004-x64
1Debloat-Wi...wn.ps1
windows7-x64
1Debloat-Wi...wn.ps1
windows10-2004-x64
1Debloat-Wi...ry.ps1
windows7-x64
8Debloat-Wi...ry.ps1
windows10-2004-x64
8Debloat-Wi...es.ps1
windows7-x64
1Debloat-Wi...es.ps1
windows10-2004-x64
1Debloat-Wi...er.ps1
windows7-x64
10Debloat-Wi...er.ps1
windows10-2004-x64
10Debloat-Wi...ry.ps1
windows7-x64
4Debloat-Wi...ry.ps1
windows10-2004-x64
7Debloat-Wi...gs.ps1
windows7-x64
1Debloat-Wi...gs.ps1
windows10-2004-x64
1Debloat-Wi...ce.ps1
windows7-x64
10Debloat-Wi...ce.ps1
windows10-2004-x64
10Debloat-Wi...te.ps1
windows7-x64
8Debloat-Wi...te.ps1
windows10-2004-x64
8Debloat-Wi...ps.ps1
windows7-x64
1Debloat-Wi...ps.ps1
windows10-2004-x64
7Debloat-Wi...ve.ps1
windows7-x64
1Debloat-Wi...ve.ps1
windows10-2004-x64
8Debloat-Wi...up.bat
windows7-x64
1Debloat-Wi...up.bat
windows10-2004-x64
1Debloat-Wi...st.bat
windows7-x64
1Debloat-Wi...st.bat
windows10-2004-x64
1Debloat-Wi...on.ps1
windows7-x64
1Debloat-Wi...on.ps1
windows10-2004-x64
1Debloat-Wi...ch.ps1
windows7-x64
1Debloat-Wi...ch.ps1
windows10-2004-x64
1Debloat-Wi...ks.ps1
windows7-x64
1Debloat-Wi...ks.ps1
windows10-2004-x64
1Analysis
- max time kernel
134s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240226-es - resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
03/04/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
Debloat-Windows-10-master/lib/New-FolderForced.ps1
Resource
win7-20231129-es
windows7-x64
Behavioral task
behavioral2
Sample
Debloat-Windows-10-master/lib/New-FolderForced.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral3
Sample
Debloat-Windows-10-master/lib/take-own.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral4
Sample
Debloat-Windows-10-master/lib/take-own.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral5
Sample
Debloat-Windows-10-master/scripts/block-telemetry.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral6
Sample
Debloat-Windows-10-master/scripts/block-telemetry.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral7
Sample
Debloat-Windows-10-master/scripts/disable-services.ps1
Resource
win7-20240220-es
windows7-x64
Behavioral task
behavioral8
Sample
Debloat-Windows-10-master/scripts/disable-services.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral9
Sample
Debloat-Windows-10-master/scripts/disable-windows-defender.ps1
Resource
win7-20231129-es
windows7-x64
Behavioral task
behavioral10
Sample
Debloat-Windows-10-master/scripts/disable-windows-defender.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral11
Sample
Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral12
Sample
Debloat-Windows-10-master/scripts/experimental_unfuckery.ps1
Resource
win10v2004-20240319-es
windows10-2004-x64
Behavioral task
behavioral13
Sample
Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral14
Sample
Debloat-Windows-10-master/scripts/fix-privacy-settings.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral15
Sample
Debloat-Windows-10-master/scripts/optimize-user-interface.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral16
Sample
Debloat-Windows-10-master/scripts/optimize-user-interface.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral17
Sample
Debloat-Windows-10-master/scripts/optimize-windows-update.ps1
Resource
win7-20231129-es
windows7-x64
Behavioral task
behavioral18
Sample
Debloat-Windows-10-master/scripts/optimize-windows-update.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral19
Sample
Debloat-Windows-10-master/scripts/remove-default-apps.ps1
Resource
win7-20240220-es
windows7-x64
Behavioral task
behavioral20
Sample
Debloat-Windows-10-master/scripts/remove-default-apps.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral21
Sample
Debloat-Windows-10-master/scripts/remove-onedrive.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral22
Sample
Debloat-Windows-10-master/scripts/remove-onedrive.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral23
Sample
Debloat-Windows-10-master/utils/boot-advanced-startup.bat
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral24
Sample
Debloat-Windows-10-master/utils/boot-advanced-startup.bat
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral25
Sample
Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral26
Sample
Debloat-Windows-10-master/utils/disable-ShellExperienceHost.bat
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral27
Sample
Debloat-Windows-10-master/utils/disable-memory-compression.ps1
Resource
win7-20240221-es
windows7-x64
Behavioral task
behavioral28
Sample
Debloat-Windows-10-master/utils/disable-memory-compression.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral29
Sample
Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1
Resource
win7-20240319-es
windows7-x64
Behavioral task
behavioral30
Sample
Debloat-Windows-10-master/utils/disable-prefetch-prelaunch.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral31
Sample
Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1
Resource
win7-20240220-es
windows7-x64
Behavioral task
behavioral32
Sample
Debloat-Windows-10-master/utils/disable-scheduled-tasks.ps1
Resource
win10v2004-20240226-es
windows10-2004-x64
General
- Target Debloat-Windows-10-master/scripts/block-telemetry.ps1
- Size 8KB
- Sample240403-db43tseb49
- SHA256 b40f2671440e894f1b2f1bbdeb0c73556363f21d0f081c973828902d00bac487
- MD5 350e535ff63674fe00467498a6cb8af5
- SHA1 ea949080b1f0e650c97da8c165a5da2fbc20f29d
- SHA512 1030b7428490dc447ac9c09539b0b800198773021d6cbbd6f737caab43ec8efead581773f6696424f216e0abcf73a9f969c4899036e081346aa417e0cbaa6a2a
- SSDEEP 192:us8Vn4cehexLYQcyaNICiD71iyBHEeyug:us8VPehab4NICiD78EI9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts powershell.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3040 powershell.exe 3040 powershell.exe 3040 powershell.exe 4636 msedge.exe 4636 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3040 powershell.exe Token: SeIncreaseQuotaPrivilege 3040 powershell.exe Token: SeSecurityPrivilege 3040 powershell.exe Token: SeTakeOwnershipPrivilege 3040 powershell.exe Token: SeLoadDriverPrivilege 3040 powershell.exe Token: SeSystemProfilePrivilege 3040 powershell.exe Token: SeSystemtimePrivilege 3040 powershell.exe Token: SeProfSingleProcessPrivilege 3040 powershell.exe Token: SeIncBasePriorityPrivilege 3040 powershell.exe Token: SeCreatePagefilePrivilege 3040 powershell.exe Token: SeBackupPrivilege 3040 powershell.exe Token: SeRestorePrivilege 3040 powershell.exe Token: SeShutdownPrivilege 3040 powershell.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeSystemEnvironmentPrivilege 3040 powershell.exe Token: SeRemoteShutdownPrivilege 3040 powershell.exe Token: SeUndockPrivilege 3040 powershell.exe Token: SeManageVolumePrivilege 3040 powershell.exe Token: 33 3040 powershell.exe Token: 34 3040 powershell.exe Token: 35 3040 powershell.exe Token: 36 3040 powershell.exe Token: SeIncreaseQuotaPrivilege 3040 powershell.exe Token: SeSecurityPrivilege 3040 powershell.exe Token: SeTakeOwnershipPrivilege 3040 powershell.exe Token: SeLoadDriverPrivilege 3040 powershell.exe Token: SeSystemProfilePrivilege 3040 powershell.exe Token: SeSystemtimePrivilege 3040 powershell.exe Token: SeProfSingleProcessPrivilege 3040 powershell.exe Token: SeIncBasePriorityPrivilege 3040 powershell.exe Token: SeCreatePagefilePrivilege 3040 powershell.exe Token: SeBackupPrivilege 3040 powershell.exe Token: SeRestorePrivilege 3040 powershell.exe Token: SeShutdownPrivilege 3040 powershell.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeSystemEnvironmentPrivilege 3040 powershell.exe Token: SeRemoteShutdownPrivilege 3040 powershell.exe Token: SeUndockPrivilege 3040 powershell.exe Token: SeManageVolumePrivilege 3040 powershell.exe Token: 33 3040 powershell.exe Token: 34 3040 powershell.exe Token: 35 3040 powershell.exe Token: 36 3040 powershell.exe Token: SeIncreaseQuotaPrivilege 3040 powershell.exe Token: SeSecurityPrivilege 3040 powershell.exe Token: SeTakeOwnershipPrivilege 3040 powershell.exe Token: SeLoadDriverPrivilege 3040 powershell.exe Token: SeSystemProfilePrivilege 3040 powershell.exe Token: SeSystemtimePrivilege 3040 powershell.exe Token: SeProfSingleProcessPrivilege 3040 powershell.exe Token: SeIncBasePriorityPrivilege 3040 powershell.exe Token: SeCreatePagefilePrivilege 3040 powershell.exe Token: SeBackupPrivilege 3040 powershell.exe Token: SeRestorePrivilege 3040 powershell.exe Token: SeShutdownPrivilege 3040 powershell.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeSystemEnvironmentPrivilege 3040 powershell.exe Token: SeRemoteShutdownPrivilege 3040 powershell.exe Token: SeUndockPrivilege 3040 powershell.exe Token: SeManageVolumePrivilege 3040 powershell.exe Token: 33 3040 powershell.exe Token: 34 3040 powershell.exe Token: 35 3040 powershell.exe Token: 36 3040 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\block-telemetry.ps11⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5516 --field-trial-handle=2004,i,3518780201612530827,12523116488201166376,262144 --variations-seed-version /prefetch:81⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1896 --field-trial-handle=2004,i,3518780201612530827,12523116488201166376,262144 --variations-seed-version /prefetch:81⤵PID:3584
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iogqt0b3.3n2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 3KB
- SHA256 e8190d4dc2bdd29043feecc1b9de4f7c5d3bd6e5761eae6060f1a3bb1eb7b274
- MD5 ea62eb584095cd644dca83f38db393be
- SHA1 15f163f3a32a23f30ca6e0176d390a4a070059d9
- SHA512 dd1779fcf5c53b464bc9ea40ffdb897f731c0b6a438637f11bbaa2a2a3dad4ba964a908d2e364e8e1ac3a6b5a33f955d603371baa07c8971e73bb45a954559e8
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 3KB
- SHA256 9a16c88ef4f7fd9d98efd8a46b3c5e3b764968397fb4d3b418d5012607da3957
- MD5 5ee2ca65412e021605bb6a2cf4d14745
- SHA1 453b40c4cf8731cc1477addf8594b9b6406b9c36
- SHA512 729d341c424b5833a8253d4eeba82b3707702c552aa93e4106a9bdae7737a125c1491a0d63d626a07cb794e6a4dd98a8a64534bfd65d759bcf8a7aba0c2e8704
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 4KB
- SHA256 7f0a2c71e789d2eca5cf7ce668ce4ae55bffd1bf7e7f55aa20358923eeef583a
- MD5 c8e30a00a30c7b972472233ffffc021f
- SHA1 09a35c6e612b68757e8e3034f32be761a2366323
- SHA512 2a0a85c92c5d8046758d58b4d0d44187da5a09b648a04b22af2b153f614f38c2c5946bb578f4ed7b7b4e081be92480d0304490c5de262a55b8116e3989063d6c
- SSDEEP 96:vDZEurK9DvBCB1/1I6/oMVE47BvfYA1AiHH5XWNfCuDBM//OqBIdhhzl:RrK9zBCB1/154q3o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\etc\hosts
- Size 1KB
- SHA256 238eb11098fc5523127f0767d1b282711167a19c583d5ac791d4c3550501f1cf
- MD5 c59628b3c0bd52eff3f33d9d6eaebdb3
- SHA1 71d3e9b901f4ef913a632857145ccffb5dfc9c19
- SHA512 3607200227a5a8fb316271805cdef37edf3a6b6a1b3eb83856cd2638b3b775d9027ca90da1ec6adec4d43a0d2e1cd2dda0c8f25822647677d693d11f57a77745
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 1KB
- SHA256 ead40f9510bda5313f16e6f5e515677c6abc2e19a6f84d29f2a3b7e0df0f1474
- MD5 b102d046af1765b999bead50a79a5934
- SHA1 1c1b48270affc9a43a7981fe3ec9d071e443ffab
- SHA512 4b734fcb5a0e26952f3eb6c255fff4f6ca79b3d32bef5621b6e2091db90fb11fd8b94b23fd90b713f45c7a0c2fd23f5c3ba1ad099bfc0b70d07cb761b196f288
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 1KB
- SHA256 97e33a39d4f4de8843327f7cc010b28fd623f8133a8a2938e564e95f8910499e
- MD5 b3609638be35b94d14014205f498bde0
- SHA1 df611ba47560c2a64f3be02e8185e2bed48dcbc9
- SHA512 ee62fba1e6e682fe23a7a499c7b88efa81f3d955fccb6b0c481ad01feda64548eaf491cf5272d5e5832948fa0ad253c9312a9c90602a580729f2cb2dbac789e4
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\etc\hosts
- Size 2KB
- SHA256 a82cba5fe8d63bf5e6745d5e6daf9b260a1ef0f5bd67f26e8f37ad4544305402
- MD5 f49db96f7e0578e09a80c77440fea1c4
- SHA1 54a69f26eaf447acbc660d7d6084b5562acbd2fa
- SHA512 a13a563c6dce0b820ff63777d1304c64da48276d8ff933da6e0e2da7cba9ed44da3e1f5ab7bf3ee2406b090c72aa1a8eb14e1233e7cedfdc58621f69bc902181
- MD5 SHA1 SHA512