Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 15:05

General

  • Target

    zapret-winws/service_create.cmd

  • Size

    439B

  • MD5

    9ad68202b56eda9a58dd27ca81837453

  • SHA1

    4257694d7a5ae28ef13051588ad500dab8468877

  • SHA256

    cd8dd82e233cf00a738f4fb8756df529813279018d11453e9c0f0f7556cdd054

  • SHA512

    ea1f44cfd23ee3ce50defdc3c05116d109a7af1ff6a2f63f74970d199e451bda018bee7b5bff1904d30f7b7fa2ec832f2770c002a14e8f15f8606f76f0f4a74d

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_create.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\system32\net.exe
      net stop winws1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop winws1
        3⤵
          PID:2904
      • C:\Windows\system32\sc.exe
        sc delete winws1
        2⤵
        • Launches sc.exe
        PID:2912
      • C:\Windows\system32\sc.exe
        sc create winws1 binPath= "\"C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe\" --wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig" DisplayName= "zapret DPI bypass : winws1" start= auto
        2⤵
        • Launches sc.exe
        PID:1892
      • C:\Windows\system32\sc.exe
        sc description winws1 "zapret DPI bypass software"
        2⤵
        • Launches sc.exe
        PID:2284
      • C:\Windows\system32\sc.exe
        sc start winws1
        2⤵
        • Launches sc.exe
        PID:2788
    • C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
      "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-l3=ipv4,ipv6 --wf-tcp=80,443 --dpi-desync=fake,split --dpi-desync-ttl=7 --dpi-desync-fooling=md5sig
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1020-1-0x0000000100400000-0x0000000100446000-memory.dmp

      Filesize

      280KB

    • memory/1020-0-0x000007FEF6390000-0x000007FEF66A2000-memory.dmp

      Filesize

      3.1MB

    • memory/1020-4-0x0000000062800000-0x0000000062813000-memory.dmp

      Filesize

      76KB

    • memory/1020-3-0x000007FEF6390000-0x000007FEF66A2000-memory.dmp

      Filesize

      3.1MB

    • memory/1020-2-0x0000000100400000-0x0000000100446000-memory.dmp

      Filesize

      280KB