C:\Users\Belim\Desktop\ThisIsWin11\src\TIW11\obj\Debug\ThisIsWin11.pdb
Overview
overview
10Static
static
10ThisIsWin11.exe
windows7-x64
1ThisIsWin11.exe
windows10-2004-x64
1data/plugi...Ve.dll
windows7-x64
1data/plugi...Ve.dll
windows10-2004-x64
1data/plugi...ff.bat
windows7-x64
1data/plugi...ff.bat
windows10-2004-x64
1data/plugi...on.bat
windows7-x64
1data/plugi...on.bat
windows10-2004-x64
1data/plugi...ff.bat
windows7-x64
1data/plugi...ff.bat
windows10-2004-x64
1data/plugi...on.bat
windows7-x64
1data/plugi...on.bat
windows10-2004-x64
1data/scrip...de.ps1
windows7-x64
3data/scrip...de.ps1
windows10-2004-x64
3data/scrip...ps.ps1
windows7-x64
3data/scrip...ps.ps1
windows10-2004-x64
3data/scrip...ps.ps1
windows7-x64
3data/scrip...ps.ps1
windows10-2004-x64
3data/scrip...ve.ps1
windows7-x64
3data/scrip...ve.ps1
windows10-2004-x64
8data/scrip...d).ps1
windows7-x64
3data/scrip...d).ps1
windows10-2004-x64
7data/scrip...d).ps1
windows7-x64
3data/scrip...d).ps1
windows10-2004-x64
3data/scrip...ps.ps1
windows7-x64
3data/scrip...ps.ps1
windows10-2004-x64
3data/scrip...es.ps1
windows7-x64
8data/scrip...es.ps1
windows10-2004-x64
8data/scrip...ct.ps1
windows7-x64
3data/scrip...ct.ps1
windows10-2004-x64
8data/scrip...de.ps1
windows7-x64
3data/scrip...de.ps1
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
ThisIsWin11.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ThisIsWin11.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
data/plugins/Albacore.ViVe.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
data/plugins/Albacore.ViVe.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
data/plugins/aal_off.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
data/plugins/aal_off.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
data/plugins/aal_on.bat
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
data/plugins/aal_on.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
data/plugins/tpm_off.bat
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
data/plugins/tpm_off.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
data/plugins/tpm_on.bat
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
data/plugins/tpm_on.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
data/scripts/Apps/Enable apps dark mode.ps1
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
data/scripts/Apps/Enable apps dark mode.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
data/scripts/Apps/Install apps.ps1
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
data/scripts/Apps/Install apps.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
data/scripts/Apps/Reinstall all built-in apps.ps1
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
data/scripts/Apps/Reinstall all built-in apps.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
data/scripts/Apps/Remove OneDrive.ps1
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
data/scripts/Apps/Remove OneDrive.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
data/scripts/Apps/Remove default apps (Provisioned).ps1
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
data/scripts/Apps/Remove default apps (Provisioned).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
data/scripts/Apps/Remove default apps (Recommended).ps1
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
data/scripts/Apps/Remove default apps (Recommended).ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
data/scripts/Apps/Update Store apps.ps1
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
data/scripts/Apps/Update Store apps.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
data/scripts/Edge/Bypass Edge as default handler for web searches.ps1
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
data/scripts/Edge/Bypass Edge as default handler for web searches.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
data/scripts/Edge/Run MSEdgeRedirect.ps1
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
data/scripts/Edge/Run MSEdgeRedirect.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
data/scripts/Energy/Ultimate Performance mode.ps1
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
data/scripts/Energy/Ultimate Performance mode.ps1
Resource
win10v2004-20240611-en
General
-
Target
TIW11.zip
-
Size
103KB
-
MD5
e4f848d40fe13a09a9853ae3c65dbf7a
-
SHA1
18eb930142db4e829834b16b6ca2565b239d1207
-
SHA256
e05bddb512d944bee1c7006389e5c8302101bce559d1f869ee78912dc333bebe
-
SHA512
2a97852f87ec8e7824d176239d90bfc0693367941e178b2424a4dc5ede54daf9132d78dffff319d5546d6fd827eefa3c6987b0f27913c647df1e004ce7d88b40
-
SSDEEP
1536:CA793NLPVia9npEYVSGqIsu6GR9IX+DYIT0N48SVkcbdjwaLMHXg5S+zgEWka4:CA/LP8oTN6OKuT0N48Ck2UwE4
Malware Config
Extracted
https://github.com/rcmaehl/MSEdgeRedirect/releases/download/0.6.1.0/MSEdgeRedirect.exe
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ThisIsWin11.exe unpack001/data/plugins/Albacore.ViVe.dll
Files
-
TIW11.zip.zip
-
ThisIsWin11.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 255KB - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
data/apps11.txt
-
data/opentweaks_gamingProfile.tiw1
-
data/opentweaks_oobeProfile.tiw1
-
data/packages11.xml
-
data/plugins/Albacore.ViVe.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\Star\source\gitrepos\ViVe\ViVe\obj\Release\Albacore.ViVe.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
data/plugins/Disable TPM 2.0 Check.ini
-
data/plugins/Enable AutoAdminLogon.ini
-
data/plugins/Enable Classic Context menus.ini
-
data/plugins/Join Domain.ini
-
data/plugins/Win10X Boot Animation.ini
-
data/plugins/aal_off.bat
-
data/plugins/aal_on.bat
-
data/plugins/tpm_off.bat
-
data/plugins/tpm_on.bat
-
data/scripts/Apps/Enable apps dark mode.ps1
-
data/scripts/Apps/Install apps.ps1
-
data/scripts/Apps/Reinstall all built-in apps.ps1
-
data/scripts/Apps/Remove OneDrive.ps1.ps1
-
data/scripts/Apps/Remove default apps (Provisioned).ps1
-
data/scripts/Apps/Remove default apps (Recommended).ps1
-
data/scripts/Apps/Update Store apps.ps1.ps1
-
data/scripts/Edge/Bypass Edge as default handler for web searches.ps1.ps1
-
data/scripts/Edge/Run MSEdgeRedirect.ps1.ps1
-
data/scripts/Energy/Ultimate Performance mode.ps1
-
data/scripts/Privacy/Disable Services.ps1.ps1
-
data/scripts/Privacy/Remove telemetry of third-party apps.ps1.ps1
-
data/scripts/Storage/Clean up Windows.ps1.ps1
-
data/scripts/logs/Update Store apps.txt.ps1