129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 15:05

Sharing

Report Analysis Logs

General

Target

zapret-winws/service_stop.cmd
Size

38B
MD5

5533593bf6aae9330b67e0ae8c68b3f4
SHA1

39d7c7a6f6e64486a36de804175a381372406aad
SHA256

1d5dd1ef31643bc269bbfa3886ceb45acde1612840c3501535b09e6240b8c7d5
SHA512

a33eea7e551b05650d84ce012955be04d0c998cf6abd7de182a296c279080c2fd8c87690e9ddd4e16728e3fa4827a039baa0aa4c0316d052a868ef9cf4903cd2

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2024	2596	cmd.exe	31
PID 2596 wrote to memory of 2024	2596	cmd.exe	31
PID 2596 wrote to memory of 2024	2596	cmd.exe	31
PID 2024 wrote to memory of 2612	2024	net.exe	32
PID 2024 wrote to memory of 2612	2024	net.exe	32
PID 2024 wrote to memory of 2612	2024	net.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_stop.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\net.exe
  net stop winws1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winws1
    3⤵
    PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads