Analysis
- max time kernel
45s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 23:56
General
- Target WinDebloater-main/Windows10DebloaterGUI.ps1
- Size 85KB
- Sample261027-3y8f7swt2r
- SHA256 60eda38fe71bb13755d3e2457df4dffc83efec4258bfb9578b062ee53b274ab5
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WinDebloater-main\Windows10DebloaterGUI.ps11⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {0B387081-5181-49F1-8750-89382B921A7F}2⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3 /All2⤵
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {0BDFA47B-1F19-48DB-A438-5DD1127D4362}3⤵
-
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3 /All2⤵
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {05E30196-EA45-4806-9C45-762B532F157F}3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
__PSScriptPolicyTest_kz5jfuns.2e5.psm1
dism.log
dism.log
dism.log
dism.log
dism.log
memory/3164-291-0x0000021093D70000-0x0000021093E70000-memory.dmp
memory/3164-319-0x0000021094110000-0x0000021094130000-memory.dmp
memory/3164-305-0x0000021083B70000-0x0000021083B90000-memory.dmp
memory/3164-290-0x0000021083930000-0x0000021083950000-memory.dmp
memory/3164-272-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/3164-274-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/3164-273-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/3308-17-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-15-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-19-0x00000252FDCF0000-0x00000252FDCF8000-memory.dmp
memory/3308-27-0x00000252FE170000-0x00000252FE17A000-memory.dmp
memory/3308-28-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-29-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-24-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-30-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-31-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-32-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-33-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-34-0x00000252FE690000-0x00000252FE6B8000-memory.dmp
memory/3308-23-0x00000252FE190000-0x00000252FE1B6000-memory.dmp
memory/3308-54-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-55-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-56-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-22-0x00000252FDD20000-0x00000252FDD28000-memory.dmp
memory/3308-3-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-4-0x00000252FDC70000-0x00000252FDC92000-memory.dmp
memory/3308-5-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-6-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-7-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-8-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-11-0x00000252FDCF0000-0x00000252FDD0E000-memory.dmp
memory/3308-21-0x00000252FDD10000-0x00000252FDD1A000-memory.dmp
memory/3308-18-0x00000252FE660000-0x00000252FE68A000-memory.dmp
memory/3308-0-0x00007FFD4F30F000-0x00007FFD4F310000-memory.dmp
memory/3308-16-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp
memory/3308-20-0x00000252FDD00000-0x00000252FDD06000-memory.dmp
memory/3308-13-0x00000252FE870000-0x00000252FEA74000-memory.dmp
memory/3308-14-0x00000252FE140000-0x00000252FE15A000-memory.dmp
memory/3308-12-0x00000252FE080000-0x00000252FE132000-memory.dmp
memory/4052-77-0x000001D7BEB30000-0x000001D7BEC30000-memory.dmp
memory/4052-78-0x000001D7BEB30000-0x000001D7BEC30000-memory.dmp
memory/4052-79-0x000001D7BEB30000-0x000001D7BEC30000-memory.dmp
memory/4052-104-0x000001D783660000-0x000001D783680000-memory.dmp
memory/4052-90-0x000001D793730000-0x000001D793830000-memory.dmp
memory/4052-124-0x000001D793AE0000-0x000001D793B00000-memory.dmp
memory/4052-89-0x000001D7833E0000-0x000001D783400000-memory.dmp