Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
5zapret-dis...rt.dll
windows7-x64
1zapret-dis...rt.dll
windows10-2004-x64
1zapret-dis...64.sys
windows10-2004-x64
1zapret-dis...n1.dll
windows7-x64
5zapret-dis...n1.dll
windows10-2004-x64
5zapret-dis...rd.bat
windows7-x64
5zapret-dis...rd.bat
windows10-2004-x64
5zapret-dis...be.bat
windows7-x64
5zapret-dis...be.bat
windows10-2004-x64
5zapret-dis...rd.bat
windows7-x64
8zapret-dis...rd.bat
windows10-2004-x64
8zapret-dis...be.bat
windows7-x64
8zapret-dis...be.bat
windows10-2004-x64
8zapret-dis...ve.bat
windows7-x64
8zapret-dis...ve.bat
windows10-2004-x64
8zapret-dis...ws.exe
windows7-x64
5zapret-dis...ws.exe
windows10-2004-x64
5Analysis
-
max time kernel
96s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 15:05
Behavioral task
behavioral1
Sample
zapret-discord-youtube-main/WinDivert.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
zapret-discord-youtube-main/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zapret-discord-youtube-main/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
zapret-discord-youtube-main/cygwin1.dll
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
zapret-discord-youtube-main/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
zapret-discord-youtube-main/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
zapret-discord-youtube-main/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
zapret-discord-youtube-main/discord_youtube.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
zapret-discord-youtube-main/discord_youtube.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
zapret-discord-youtube-main/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
zapret-discord-youtube-main/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
zapret-discord-youtube-main/service_discord_youtube.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
zapret-discord-youtube-main/service_discord_youtube.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
zapret-discord-youtube-main/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
zapret-discord-youtube-main/service_remove.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
zapret-discord-youtube-main/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
zapret-discord-youtube-main/winws.exe
Resource
win10v2004-20241007-en
General
-
Target
zapret-discord-youtube-main/discord_youtube.bat
-
Size
868B
-
MD5
d142d810c39ba859f5904d4cc3386eb2
-
SHA1
c6b5c3550698460dca3fa414cdafe01ab971cea8
-
SHA256
5a65fa4a71d1f759fb8f8f00f62ea3ad1470a6b863632ab0ae8cadce99addde7
-
SHA512
2a07d7546a7fd47f9de2338c94bfe3c23692e55de419fbca753dd01dd257e609a6d6ff48fbd221095dc5eac86e50fd9f3ed95893aa615486cf0a566f052bdc87
Malware Config
Signatures
-
resource yara_rule behavioral9/memory/2672-1-0x00007FFEAF590000-0x00007FFEAF8A2000-memory.dmp upx behavioral9/memory/2672-5-0x00007FFEAF590000-0x00007FFEAF8A2000-memory.dmp upx -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2672 winws.exe Token: SeBackupPrivilege 2672 winws.exe Token: SeDebugPrivilege 2672 winws.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2672 4292 cmd.exe 84 PID 4292 wrote to memory of 2672 4292 cmd.exe 84
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\discord_youtube.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\winws.exe"C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\winws.exe" --wf-tcp=80,443,50000-65535 --wf-udp=443,50000-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\list-general.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\quic_initial_www_google_com.bin" --new --filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\list-general.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\tls_clienthello_www_google_com.bin" --new --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-