bd738f6f1b9bf79ca2725a1126f7b00127ec306b7f0c8ae25ae3f3724c7dbd46

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 13:25

Target

zapret-winws/task_start.cmd
Size

56B
MD5

bd5e60dc6bcbbf7172bfae77eba9c79c
SHA1

7c675e520ef04653a1890a8074b1b19745d44757
SHA256

62191a8a552eafdaab7aeecc7bb4d6a39edd311ac3d1de513414980c5cc7619a
SHA512

15fa1c284c9d1c87b61b2aaa2149a7e1ee314b5512a319ce3e605054ca36d8fbd0c57868eb5206568ecc9309229682c6ab905c9be1678d2e079a800dc0f31f33

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1152	3568	cmd.exe	86
PID 3568 wrote to memory of 1152	3568	cmd.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\task_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\system32\schtasks.exe
  schtasks /Run /TN winws1
  2⤵
  PID:1152

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact