Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 16:50
General
- Target Win11Debloat.exe
- Size 668KB
- Sample261104-vcchmsys4n
- SHA256 7adc72c922d022efee1d47e51d57ecfabf4b690d706704a91a60048b461ebe90
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Win11Debloat.exe"C:\Users\Admin\AppData\Local\Temp\Win11Debloat.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Add_All_Folders_Under_This_PC.reg
Disable_AI_Service_Auto_Start.reg
Disable_Bitlocker_Auto_Encryption.reg
Disable_Brave_Bloat.reg
Disable_Chrome_AI_Features.reg
Disable_Delivery_Optimization.reg
Disable_Device_Auto_App_Download.reg
Disable_Edge_AI_Features.reg
Disable_Edge_Ads_And_Suggestions.reg
Disable_Fast_Startup.reg
Disable_Find_My_Device.reg
Disable_Give_access_to_context_menu.reg
Disable_Include_in_library_from_context_menu.reg
Disable_Location_Services.reg
Disable_Modern_Standby_Networking.reg
Disable_Notepad_AI_Features.reg
Disable_Paint_AI_Features.reg
Disable_Settings_365_Ads.reg
Disable_Settings_Home.reg
Disable_Share_from_context_menu.reg
Disable_Update_ASAP.reg
Hide_3D_Objects_Folder.reg
Hide_Music_Folder.reg
Hide_duplicate_removable_drives_from_navigation_pane_of_File_Explorer.reg
Prevent_Auto_Reboot.reg
Enable_Desktop_Spotlight.reg
Enable_Desktop_Spotlight.reg
Show_Drive_Letters_Last.reg
__PSScriptPolicyTest_gag2h4cx.bih.psm1
memory/1212-775-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-780-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-557-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-0-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp
memory/1212-18-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-779-0x000000001CF30000-0x000000001CFE2000-memory.dmp
memory/1212-11-0x000000001B3C0000-0x000000001B3D2000-memory.dmp
memory/1212-697-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-8-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-7-0x0000000001110000-0x0000000001132000-memory.dmp
memory/1212-6-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-5-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-2-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-1-0x0000000000720000-0x00000000007CE000-memory.dmp
memory/1212-772-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-774-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-290-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-85-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-405-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-778-0x000000001B5E0000-0x000000001B5FE000-memory.dmp
memory/1212-10-0x0000000002AB0000-0x0000000002ABA000-memory.dmp
memory/1212-781-0x000000001CFF0000-0x000000001CFFA000-memory.dmp
memory/1212-782-0x000000001D030000-0x000000001D05A000-memory.dmp
memory/1212-783-0x000000001D030000-0x000000001D054000-memory.dmp
memory/1212-784-0x000000001D200000-0x000000001D3C2000-memory.dmp
memory/1212-787-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-786-0x000000001D900000-0x000000001DE28000-memory.dmp
memory/1212-790-0x000000001D190000-0x000000001D1AE000-memory.dmp
memory/1212-791-0x000000001D170000-0x000000001D17A000-memory.dmp
memory/1212-792-0x000000001D1D0000-0x000000001D1EC000-memory.dmp
memory/1212-793-0x000000001D180000-0x000000001D188000-memory.dmp
memory/1212-794-0x000000001D1B0000-0x000000001D1B6000-memory.dmp
memory/1212-795-0x000000001D1C0000-0x000000001D1CA000-memory.dmp
memory/1212-796-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-797-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-799-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1212-800-0x00007FF863AE0000-0x00007FF864484000-memory.dmp