Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/04/2024, 04:44

240427-fcz7daca9w 1

27/04/2024, 04:40

240427-fav5msbc24 1

Analysis

  • max time kernel
    133s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/04/2024, 04:44

General

  • Target

    Win11Debloat-master/Run.bat

  • Size

    170B

  • MD5

    b9bf23bbfd25ad541e550ddc9c4ffa27

  • SHA1

    b4d90b6c173d3a7be92f9a936c4680586b1554b4

  • SHA256

    d4f9264302284b78d95f140e79a1795ee0b442dda98d252aa8e255505ed339e3

  • SHA512

    d443313d786f48d93c6a13736ef647f48f3793a1e55f8b2232dbaaa68d21f9de553a3434809de0f47c081471ee562713649e5ea704ec3133ee1f48eb050ee5fb

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Run.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps1""' -Verb RunAs}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Win11Debloat-master\Win11Debloat.ps1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    88dc70c361a22feac57b031dd9c1f02f

    SHA1

    a9b4732260c2a323750022a73480f229ce25d46d

    SHA256

    43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

    SHA512

    19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    5caad758326454b5788ec35315c4c304

    SHA1

    3aef8dba8042662a7fcf97e51047dc636b4d4724

    SHA256

    83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

    SHA512

    4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyldbydz.yyx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2412-8-0x0000022837270000-0x0000022837292000-memory.dmp

    Filesize

    136KB

  • memory/2412-11-0x000002281EBF0000-0x000002281EC00000-memory.dmp

    Filesize

    64KB

  • memory/2412-10-0x000002281EBF0000-0x000002281EC00000-memory.dmp

    Filesize

    64KB

  • memory/2412-9-0x00007FFEAC180000-0x00007FFEACC42000-memory.dmp

    Filesize

    10.8MB

  • memory/2412-12-0x000002281EBF0000-0x000002281EC00000-memory.dmp

    Filesize

    64KB

  • memory/2412-15-0x00007FFEAC180000-0x00007FFEACC42000-memory.dmp

    Filesize

    10.8MB

  • memory/4632-29-0x000001DDB3550000-0x000001DDB355A000-memory.dmp

    Filesize

    40KB

  • memory/4632-28-0x000001DDB3570000-0x000001DDB358C000-memory.dmp

    Filesize

    112KB

  • memory/4632-30-0x000001DDB37F0000-0x000001DDB3816000-memory.dmp

    Filesize

    152KB