129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/preset_russia_autohostlist.cmd
Size

784B
MD5

260c8b9613747ad616a4e9955df3002e
SHA1

edd50faffc52ca876fbcf38b423a340237ad98d4
SHA256

802dd99d42533800204573913b40d1a9c113da8175db0c37bea4bea38ae1473d
SHA512

9e8dfe100a474e6df9b8cd269c4fafa4b9aaeae28aff0f466a8ed4e1f4fad8501551b83301d2004f74fa578c82051e0bdaa1e8e6170c173545e377e587fd93bb

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral14/memory/2956-0-0x000007FEF58B0000-0x000007FEF5BC2000-memory.dmp	upx
behavioral14/memory/2956-5-0x000007FEF58B0000-0x000007FEF5BC2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2956	1952	cmd.exe	31
PID 1952 wrote to memory of 2956	1952	cmd.exe	31
PID 1952 wrote to memory of 2956	1952	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\preset_russia_autohostlist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-tcp=80,443 --wf-udp=443 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new --filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="C:\Users\Admin\AppData\Local\Temp\zapret-winws\autohostlist.txt" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-winws\tls_clienthello_www_google_com.bin" --new --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="C:\Users\Admin\AppData\Local\Temp\zapret-winws\autohostlist.txt"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2956

memory/2956-0-0x000007FEF58B0000-0x000007FEF5BC2000-memory.dmp

Filesize
3.1MB

Download
memory/2956-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2956-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/2956-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2956-5-0x000007FEF58B0000-0x000007FEF5BC2000-memory.dmp

Filesize
3.1MB

Download