129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 15:05

Target

zapret-winws/task_start.cmd
Size

56B
MD5

bd5e60dc6bcbbf7172bfae77eba9c79c
SHA1

7c675e520ef04653a1890a8074b1b19745d44757
SHA256

62191a8a552eafdaab7aeecc7bb4d6a39edd311ac3d1de513414980c5cc7619a
SHA512

15fa1c284c9d1c87b61b2aaa2149a7e1ee314b5512a319ce3e605054ca36d8fbd0c57868eb5206568ecc9309229682c6ab905c9be1678d2e079a800dc0f31f33

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2800	3564	cmd.exe	84
PID 3564 wrote to memory of 2800	3564	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\task_start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\system32\schtasks.exe
  schtasks /Run /TN winws1
  2⤵
  PID:2800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact