Analysis
- max time kernel
93s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240226-es - resource tags
- submitted
03/04/2024, 02:50
General
- Target Debloat-Windows-10-master/scripts/disable-services.ps1
- Size 1KB
- Sample240403-db43tseb49
- SHA256 b8bd3cb0707b254046435e3351ae9331b6a3b28de1e90ce14a9dd1a3d57b8bdf
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\disable-services.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_x0i04vce.cbe.ps1
memory/2896-1-0x0000018A70290000-0x0000018A702B2000-memory.dmp
memory/2896-0-0x0000018A729A0000-0x0000018A72A22000-memory.dmp
memory/2896-2-0x00007FF9D66E0000-0x00007FF9D71A1000-memory.dmp
memory/2896-3-0x0000018A70250000-0x0000018A70260000-memory.dmp
memory/2896-14-0x0000018A70220000-0x0000018A70230000-memory.dmp
memory/2896-9-0x0000018A70250000-0x0000018A70260000-memory.dmp
memory/2896-15-0x0000018A72C40000-0x0000018A72D42000-memory.dmp
memory/2896-16-0x0000018A72910000-0x0000018A7292E000-memory.dmp
memory/2896-19-0x00007FF9D66E0000-0x00007FF9D71A1000-memory.dmp