129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/task_start.cmd
Size

56B
MD5

bd5e60dc6bcbbf7172bfae77eba9c79c
SHA1

7c675e520ef04653a1890a8074b1b19745d44757
SHA256

62191a8a552eafdaab7aeecc7bb4d6a39edd311ac3d1de513414980c5cc7619a
SHA512

15fa1c284c9d1c87b61b2aaa2149a7e1ee314b5512a319ce3e605054ca36d8fbd0c57868eb5206568ecc9309229682c6ab905c9be1678d2e079a800dc0f31f33

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2784	2400	cmd.exe	31
PID 2400 wrote to memory of 2784	2400	cmd.exe	31
PID 2400 wrote to memory of 2784	2400	cmd.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\task_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\schtasks.exe
  schtasks /Run /TN winws1
  2⤵
  PID:2784

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact