daf23fe9c7bf31cd3a54c81b9b719531e8a2635d7ba30b570dc0e4259222fc70

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 15:05

Target

zapret-discord-youtube-main/discord.bat
Size

664B
MD5

92bd2198b52fa1f69424fb254ef69e2a
SHA1

36c3337c3b37f464f1fe2a9e75bc8788451cc334
SHA256

16fc3b522c9b55c53097a58dda7757343838e2a75c351039986e9886c34eebbc
SHA512

54ca7572dd67c92550176537cb5ad3fbd8ec9eed2f2b3a71015412a7f817f2f36ecb091efd65bd7e6e734a7b7f7d6997b6282282b82de2fd6e435b6567e2a440

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/1128-0-0x00007FFC5DFE0000-0x00007FFC5E2F2000-memory.dmp	upx
behavioral7/memory/1128-5-0x00007FFC5DFE0000-0x00007FFC5E2F2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1128	956	cmd.exe	84
PID 956 wrote to memory of 1128	956	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\discord.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\winws.exe" --wf-tcp=443 --wf-udp=443,50000-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\list-discord.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\quic_initial_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\list-discord.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\tls_clienthello_www_google_com.bin"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

memory/1128-0-0x00007FFC5DFE0000-0x00007FFC5E2F2000-memory.dmp

Filesize
3.1MB

Download
memory/1128-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/1128-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/1128-5-0x00007FFC5DFE0000-0x00007FFC5E2F2000-memory.dmp

Filesize
3.1MB

Download
memory/1128-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download