General
- Target CrapFixer.zip
- Size 162KB
- Sample260509-c8y3eahz8v
- SHA256 74092840e220680e9c9fe8b076d99236ae992df680a421bf0d43c4e60d43b54f
Malware Config
Extracted
-
ps1
-
exe.dropper
https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1
Targets
-
- Target plugins/ChrisTitusApp.ps1
- Size 31B
- SHA256 eebe8360d6ea28a4963a6d98fac9ddd7ada2a2b238bcafaf0c62e3f5080b46ab
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
- Target plugins/Create Restore Point.ps1
- Size 1KB
- SHA256 995fe8067c38eebb7da0bc209bb64c3db617082befcb580b26c66be66b4c3934
Score3/10 -
- Target plugins/Disable Snap Assist Flyout (NX).ps1
- Size 1KB
- SHA256 804a6e198d3f3e6622628628a9b5882620e284bbeb6738a7d316591802aa37d7
Score3/10 -
- Target plugins/File Extensions Visibility (NX).ps1
- Size 1KB
- SHA256 a74945729e4198c97190139dc81fdce97ae24508ffe066f2665e24e913c4e336
Score3/10 -
- Target plugins/Remove Ask Copilot (NX).ps1
- Size 771B
- SHA256 f41d6479e264facc4895cb33b7cd4e1afda0a0cd134656aef555ba98ac999df0
Score3/10 -
- Target plugins/Remove Edit with Clipchamp (NX).ps1
- Size 793B
- SHA256 5a4b63b53a2e1cea6237921faba43bf2d8987b9004d7a41805f77f20bfefa3c2
Score3/10 -
- Target plugins/Remove Edit with Notepad (NX).ps1
- Size 783B
- SHA256 410e19fa0caa8bc469eb6edf9f873679ce06689a330d1034781223963c066612
Score3/10 -
- Target plugins/Remove Edit with Photos (NX).ps1
- Size 779B
- SHA256 2f46d02ed648b507e5617cc0cfae79d7b8290e9accfb6b89f61d805a12e2281f
Score3/10 -
- Target plugins/Remove Windows AI.ps1
- Size 94B
- SHA256 fb3cb769f1837c261882dfbabf94f4a6ff4cef21f13fe2e70c356d79515f327c
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target plugins/Remove default apps.ps1
- Size 5KB
- SHA256 1ff3eca8f31c3c0cbda239a7cf99f435f5525e25513490c47c163cf0c67dfc84
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target plugins/Restart Explorer.ps1
- Size 496B
- SHA256 028b5927b29edf26220cf2ee493a7947a9388cad58f9f1d82b2d2385acde905c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins/Restore all built-in apps.ps1
- Size 1KB
- SHA256 9563aaa0aa41bb9762c4f84bbc0892831f804b0343fc08b1e4a665230a60331c
Score3/10 -
- Target plugins/Shutdown Time (NX).ps1
- Size 1KB
- SHA256 dcdfd73927bedf0decfcad6d7dc81f17302735b9ea4f1c034b359939ae4990fa
Score3/10 -
- Target plugins/Uninstall OneDrive.ps1
- Size 3KB
- SHA256 4952c34a1bd0256e4095565e597018eaf015207ef374a4a9dd6ee243af6bc6de
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins/User Account Control (NX).ps1
- Size 1KB
- SHA256 6e0d0c8a2bef2644bb38aece00725b287ad5d2947503b995a6460396ec6f24b0
Score3/10 -
- Target scripts/ChrisTitusApp.ps1
- Size 742B
- SHA256 807cfa63e4ba3964a4ceed31addb5580081890e6bce2e5714b94ea237c6084aa
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1