Overview
overview
8Static
static
5zapret-winws/1.cmd
windows7-x64
5zapret-winws/1.cmd
windows10-2004-x64
5zapret-winws/2.cmd
windows7-x64
5zapret-winws/2.cmd
windows10-2004-x64
5zapret-win...rt.dll
windows7-x64
1zapret-win...rt.dll
windows10-2004-x64
1zapret-win...64.sys
windows10-2004-x64
1zapret-winws/all.cmd
windows7-x64
5zapret-winws/all.cmd
windows10-2004-x64
5zapret-win...n1.dll
windows7-x64
5zapret-win...n1.dll
windows10-2004-x64
5zapret-win...or.vbs
windows7-x64
1zapret-win...or.vbs
windows10-2004-x64
1zapret-win...st.cmd
windows7-x64
5zapret-win...st.cmd
windows10-2004-x64
5zapret-win...te.cmd
windows7-x64
8zapret-win...te.cmd
windows10-2004-x64
8zapret-win...el.cmd
windows7-x64
8zapret-win...el.cmd
windows10-2004-x64
8zapret-win...rt.cmd
windows7-x64
4zapret-win...rt.cmd
windows10-2004-x64
4zapret-win...op.cmd
windows7-x64
1zapret-win...op.cmd
windows10-2004-x64
1zapret-win...te.cmd
windows7-x64
1zapret-win...te.cmd
windows10-2004-x64
1zapret-win...ve.cmd
windows7-x64
1zapret-win...ve.cmd
windows10-2004-x64
1zapret-win...rt.cmd
windows7-x64
1zapret-win...rt.cmd
windows10-2004-x64
1zapret-win...op.cmd
windows7-x64
1zapret-win...op.cmd
windows10-2004-x64
1zapret-win...ws.exe
windows7-x64
5Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 15:05
Behavioral task
behavioral1
Sample
zapret-winws/1.cmd
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
zapret-winws/1.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zapret-winws/2.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
zapret-winws/2.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
zapret-winws/WinDivert.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
zapret-winws/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
zapret-winws/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
zapret-winws/all.cmd
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
zapret-winws/all.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
zapret-winws/cygwin1.dll
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
zapret-winws/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
zapret-winws/elevator.vbs
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
zapret-winws/elevator.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
zapret-winws/preset_russia_autohostlist.cmd
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
zapret-winws/preset_russia_autohostlist.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
zapret-winws/service_create.cmd
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
zapret-winws/service_create.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
zapret-winws/service_del.cmd
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
zapret-winws/service_del.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
zapret-winws/service_start.cmd
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
zapret-winws/service_start.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
zapret-winws/service_stop.cmd
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
zapret-winws/service_stop.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
zapret-winws/task_create.cmd
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
zapret-winws/task_create.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
zapret-winws/task_remove.cmd
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
zapret-winws/task_remove.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
zapret-winws/task_start.cmd
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
zapret-winws/task_start.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
zapret-winws/task_stop.cmd
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
zapret-winws/task_stop.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
zapret-winws/winws.exe
Resource
win7-20240903-en
General
-
Target
zapret-winws/service_create.cmd
-
Size
439B
-
MD5
9ad68202b56eda9a58dd27ca81837453
-
SHA1
4257694d7a5ae28ef13051588ad500dab8468877
-
SHA256
cd8dd82e233cf00a738f4fb8756df529813279018d11453e9c0f0f7556cdd054
-
SHA512
ea1f44cfd23ee3ce50defdc3c05116d109a7af1ff6a2f63f74970d199e451bda018bee7b5bff1904d30f7b7fa2ec832f2770c002a14e8f15f8606f76f0f4a74d
Malware Config
Signatures
-
Creates new service(s) 2 TTPs
-
resource yara_rule behavioral16/memory/1020-0-0x000007FEF6390000-0x000007FEF66A2000-memory.dmp upx behavioral16/memory/1020-3-0x000007FEF6390000-0x000007FEF66A2000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1892 sc.exe 2912 sc.exe 2284 sc.exe 2788 sc.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1020 winws.exe Token: SeBackupPrivilege 1020 winws.exe Token: SeDebugPrivilege 1020 winws.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2860 1656 cmd.exe 29 PID 1656 wrote to memory of 2860 1656 cmd.exe 29 PID 1656 wrote to memory of 2860 1656 cmd.exe 29 PID 2860 wrote to memory of 2904 2860 net.exe 30 PID 2860 wrote to memory of 2904 2860 net.exe 30 PID 2860 wrote to memory of 2904 2860 net.exe 30 PID 1656 wrote to memory of 2912 1656 cmd.exe 31 PID 1656 wrote to memory of 2912 1656 cmd.exe 31 PID 1656 wrote to memory of 2912 1656 cmd.exe 31 PID 1656 wrote to memory of 1892 1656 cmd.exe 32 PID 1656 wrote to memory of 1892 1656 cmd.exe 32 PID 1656 wrote to memory of 1892 1656 cmd.exe 32 PID 1656 wrote to memory of 2284 1656 cmd.exe 33 PID 1656 wrote to memory of 2284 1656 cmd.exe 33 PID 1656 wrote to memory of 2284 1656 cmd.exe 33 PID 1656 wrote to memory of 2788 1656 cmd.exe 34 PID 1656 wrote to memory of 2788 1656 cmd.exe 34 PID 1656 wrote to memory of 2788 1656 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_create.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\net.exenet stop winws12⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winws13⤵PID:2904
-
-
-
C:\Windows\system32\sc.exesc delete winws12⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\system32\sc.exesc create winws1 binPath= "\"C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe\" --wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig" DisplayName= "zapret DPI bypass : winws1" start= auto2⤵
- Launches sc.exe
PID:1892
-
-
C:\Windows\system32\sc.exesc description winws1 "zapret DPI bypass software"2⤵
- Launches sc.exe
PID:2284
-
-
C:\Windows\system32\sc.exesc start winws12⤵
- Launches sc.exe
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe"C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020