bd738f6f1b9bf79ca2725a1126f7b00127ec306b7f0c8ae25ae3f3724c7dbd46

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 13:25

Target

zapret-winws/1.cmd
Size

148B
MD5

b5ec55dd0d83a7822d1262078f2c1a55
SHA1

d53a59d2722f617f4a18625d3600f8befa66104c
SHA256

dcfefd4ce292e764604f461c00b0db5b1aed5f994823ef25fd5faa8663b6970f
SHA512

4a24bfc6349bdaf5ffbc95f007dd899480b517cced8a129192f8cd8d83b1373348bd27d0384beb7b46cf245dfc150c043d894c457ed6b1fafdf9d19849e96708

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/444-0-0x00007FFFA2BF0000-0x00007FFFA2F02000-memory.dmp	upx
behavioral2/memory/444-5-0x00007FFFA2BF0000-0x00007FFFA2F02000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 444	1472	cmd.exe	85
PID 1472 wrote to memory of 444	1472	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\1.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-udp=50000-65535 --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:444

memory/444-0-0x00007FFFA2BF0000-0x00007FFFA2F02000-memory.dmp

Filesize
3.1MB

Download
memory/444-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/444-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/444-5-0x00007FFFA2BF0000-0x00007FFFA2F02000-memory.dmp

Filesize
3.1MB

Download
memory/444-3-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download