Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/04/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
Win11Debloat-master/Run.bat
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
Win11Debloat-master/Win11Debloat.ps1
Resource
win11-20240419-en
General
-
Target
Win11Debloat-master/Run.bat
-
Size
170B
-
MD5
b9bf23bbfd25ad541e550ddc9c4ffa27
-
SHA1
b4d90b6c173d3a7be92f9a936c4680586b1554b4
-
SHA256
d4f9264302284b78d95f140e79a1795ee0b442dda98d252aa8e255505ed339e3
-
SHA512
d443313d786f48d93c6a13736ef647f48f3793a1e55f8b2232dbaaa68d21f9de553a3434809de0f47c081471ee562713649e5ea704ec3133ee1f48eb050ee5fb
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2412 powershell.exe 2412 powershell.exe 4632 powershell.exe 4632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2412 powershell.exe Token: SeDebugPrivilege 4632 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2412 5064 cmd.exe 81 PID 5064 wrote to memory of 2412 5064 cmd.exe 81 PID 2412 wrote to memory of 4632 2412 powershell.exe 82 PID 2412 wrote to memory of 4632 2412 powershell.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps1""' -Verb RunAs}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD588dc70c361a22feac57b031dd9c1f02f
SHA1a9b4732260c2a323750022a73480f229ce25d46d
SHA25643244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
SHA51219c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82