Analysis
- max time kernel
120s - max time network
121s - platform
windows7_x64 - resource
win7-20240220-es - resource tags
- submitted
03/04/2024, 02:50
General
- Target Debloat-Windows-10-master/scripts/disable-services.ps1
- Size 1KB
- Sample240403-db43tseb49
- SHA256 b8bd3cb0707b254046435e3351ae9331b6a3b28de1e90ce14a9dd1a3d57b8bdf
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\disable-services.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3044-4-0x000000001B700000-0x000000001B9E2000-memory.dmp
memory/3044-6-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/3044-5-0x0000000002890000-0x0000000002898000-memory.dmp
memory/3044-8-0x0000000002910000-0x000000000291E000-memory.dmp
memory/3044-7-0x0000000002D00000-0x0000000002D80000-memory.dmp
memory/3044-11-0x0000000002D00000-0x0000000002D80000-memory.dmp
memory/3044-13-0x000000001B630000-0x000000001B638000-memory.dmp
memory/3044-12-0x000000001B620000-0x000000001B62A000-memory.dmp
memory/3044-10-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp
memory/3044-9-0x000000001B5D0000-0x000000001B616000-memory.dmp
memory/3044-16-0x000000001BE00000-0x000000001BE0E000-memory.dmp
memory/3044-17-0x000000001BE10000-0x000000001BE1C000-memory.dmp
memory/3044-15-0x000000001BEB0000-0x000000001BEFE000-memory.dmp
memory/3044-14-0x0000000002D00000-0x0000000002D80000-memory.dmp
memory/3044-18-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp