129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
99s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/preset_russia_autohostlist.cmd
Size

784B
MD5

260c8b9613747ad616a4e9955df3002e
SHA1

edd50faffc52ca876fbcf38b423a340237ad98d4
SHA256

802dd99d42533800204573913b40d1a9c113da8175db0c37bea4bea38ae1473d
SHA512

9e8dfe100a474e6df9b8cd269c4fafa4b9aaeae28aff0f466a8ed4e1f4fad8501551b83301d2004f74fa578c82051e0bdaa1e8e6170c173545e377e587fd93bb

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2524-1-0x00007FFE767E0000-0x00007FFE76AF2000-memory.dmp	upx
behavioral15/memory/2524-5-0x00007FFE767E0000-0x00007FFE76AF2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2524	4848	cmd.exe	84
PID 4848 wrote to memory of 2524	4848	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\preset_russia_autohostlist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-tcp=80,443 --wf-udp=443 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --new --filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="C:\Users\Admin\AppData\Local\Temp\zapret-winws\autohostlist.txt" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-winws\tls_clienthello_www_google_com.bin" --new --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --hostlist-auto="C:\Users\Admin\AppData\Local\Temp\zapret-winws\autohostlist.txt"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524

memory/2524-0-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2524-1-0x00007FFE767E0000-0x00007FFE76AF2000-memory.dmp

Filesize
3.1MB

Download
memory/2524-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2524-5-0x00007FFE767E0000-0x00007FFE76AF2000-memory.dmp

Filesize
3.1MB

Download
memory/2524-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download