129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 15:05

Sharing

Report Analysis Logs

General

Target

zapret-winws/service_start.cmd
Size

38B
MD5

d1c3c45da175b318fe11bdd65ec96913
SHA1

00da2e971dd2cc034b56355e5e0c6d210044bb44
SHA256

f396eb4c1c1c2801f294bdfd4e19c89d6b7ed7b0c5512aebd89d965a3fe46c8a
SHA512

96cfc9839bb5d1a4b7939556e8a9cee1f1ad9b39413d8f7ee88e0c36fa1de8ac4e74d25bb60bb079254ef5802e8ffa34f5a49463f68da19d692f52e8d511b799

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2700	sc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2700	2008	cmd.exe	31
PID 2008 wrote to memory of 2700	2008	cmd.exe	31
PID 2008 wrote to memory of 2700	2008	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\sc.exe
  sc start winws1
  2⤵
  - Launches sc.exe
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads