129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2 | Triage

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 15:05

Sharing

Report Analysis Logs

General

Target

zapret-winws/service_stop.cmd
Size

38B
MD5

5533593bf6aae9330b67e0ae8c68b3f4
SHA1

39d7c7a6f6e64486a36de804175a381372406aad
SHA256

1d5dd1ef31643bc269bbfa3886ceb45acde1612840c3501535b09e6240b8c7d5
SHA512

a33eea7e551b05650d84ce012955be04d0c998cf6abd7de182a296c279080c2fd8c87690e9ddd4e16728e3fa4827a039baa0aa4c0316d052a868ef9cf4903cd2

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 5116	1104	cmd.exe	86
PID 1104 wrote to memory of 5116	1104	cmd.exe	86
PID 5116 wrote to memory of 916	5116	net.exe	87
PID 5116 wrote to memory of 916	5116	net.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\service_stop.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\net.exe
  net stop winws1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winws1
    3⤵
    PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads