c001bcbda5fae22a9606964c481a51e755fcbe00fb07508d6e6d3b74152c9c65

Resubmissions

27/04/2024, 04:44

240427-fcz7daca9w 1

27/04/2024, 04:40

240427-fav5msbc24 1

Analysis

max time kernel
133s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27/04/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Win11Debloat-master/Run.bat
Size

170B
MD5

b9bf23bbfd25ad541e550ddc9c4ffa27
SHA1

b4d90b6c173d3a7be92f9a936c4680586b1554b4
SHA256

d4f9264302284b78d95f140e79a1795ee0b442dda98d252aa8e255505ed339e3
SHA512

d443313d786f48d93c6a13736ef647f48f3793a1e55f8b2232dbaaa68d21f9de553a3434809de0f47c081471ee562713649e5ea704ec3133ee1f48eb050ee5fb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2412	powershell.exe
2412	powershell.exe
4632	powershell.exe
4632	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2412	5064	cmd.exe	81
PID 5064 wrote to memory of 2412	5064	cmd.exe	81
PID 2412 wrote to memory of 4632	2412	powershell.exe	82
PID 2412 wrote to memory of 4632	2412	powershell.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps1""' -Verb RunAs}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyldbydz.yyx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2412-8-0x0000022837270000-0x0000022837292000-memory.dmp

Filesize
136KB

Download
memory/2412-11-0x000002281EBF0000-0x000002281EC00000-memory.dmp

Filesize
64KB

Download
memory/2412-10-0x000002281EBF0000-0x000002281EC00000-memory.dmp

Filesize
64KB

Download
memory/2412-9-0x00007FFEAC180000-0x00007FFEACC42000-memory.dmp

Filesize
10.8MB

Download
memory/2412-12-0x000002281EBF0000-0x000002281EC00000-memory.dmp

Filesize
64KB

Download
memory/2412-15-0x00007FFEAC180000-0x00007FFEACC42000-memory.dmp

Filesize
10.8MB

Download
memory/4632-29-0x000001DDB3550000-0x000001DDB355A000-memory.dmp

Filesize
40KB

Download
memory/4632-28-0x000001DDB3570000-0x000001DDB358C000-memory.dmp

Filesize
112KB

Download
memory/4632-30-0x000001DDB37F0000-0x000001DDB3816000-memory.dmp

Filesize
152KB

Download