Analysis
- user interaction
yes - max time kernel
21s - max time network
18s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 23:56
General
- Target WinDebloater-main/start.ps1
- Size 6KB
- Sample261027-3y8f7swt2r
- SHA256 093f4b83dfc6a7fef1075a36e3b1c4037c07f78e09d821ee0ccf97fb764817f0
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WinDebloater-main\start.ps11⤵
- Badlisted process makes network request
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {C1AC7C77-AA71-4472-9143-1E8307EB3F48}2⤵
- Drops file in Windows directory
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Windows10DebloaterGUI.ps1
__PSScriptPolicyTest_5hh35hzi.yq4.psm1
dism.log
dism.log
memory/3392-21-0x0000027E72E40000-0x0000027E72E5E000-memory.dmp
memory/3392-31-0x0000027E72E50000-0x0000027E72E6A000-memory.dmp
memory/3392-8-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-9-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-10-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-11-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-13-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-12-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-17-0x0000027E5A9A0000-0x0000027E5A9BE000-memory.dmp
memory/3392-19-0x0000027E72EA0000-0x0000027E72F52000-memory.dmp
memory/3392-18-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-20-0x0000027E72E10000-0x0000027E72E1A000-memory.dmp
memory/3392-6-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-14-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-0-0x00007FFC5270F000-0x00007FFC52710000-memory.dmp
memory/3392-23-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-5-0x0000027E5A7D0000-0x0000027E5A7F2000-memory.dmp
memory/3392-7-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-35-0x0000027E72E40000-0x0000027E72E4A000-memory.dmp
memory/3392-36-0x0000027E72E70000-0x0000027E72E78000-memory.dmp
memory/3392-37-0x0000027E73400000-0x0000027E73426000-memory.dmp
memory/3392-38-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-34-0x0000027E72E30000-0x0000027E72E36000-memory.dmp
memory/3392-33-0x0000027E5A9B0000-0x0000027E5A9B8000-memory.dmp
memory/3392-32-0x0000027E73430000-0x0000027E7345A000-memory.dmp
memory/3392-30-0x0000027E735E0000-0x0000027E737E4000-memory.dmp
memory/3392-39-0x0000027E73460000-0x0000027E73488000-memory.dmp
memory/3392-2-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-1-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-56-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-58-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-59-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/3392-60-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp