129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2 | Triage

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 15:05

Sharing

Report Analysis Logs

General

Target

zapret-winws/service_start.cmd
Size

38B
MD5

d1c3c45da175b318fe11bdd65ec96913
SHA1

00da2e971dd2cc034b56355e5e0c6d210044bb44
SHA256

f396eb4c1c1c2801f294bdfd4e19c89d6b7ed7b0c5512aebd89d965a3fe46c8a
SHA512

96cfc9839bb5d1a4b7939556e8a9cee1f1ad9b39413d8f7ee88e0c36fa1de8ac4e74d25bb60bb079254ef5802e8ffa34f5a49463f68da19d692f52e8d511b799

Score

4^/10

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3988	sc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 3988	3476	cmd.exe	84
PID 3476 wrote to memory of 3988	3476	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\system32\sc.exe
  sc start winws1
  2⤵
  - Launches sc.exe
  PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads