129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
123s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/task_stop.cmd
Size

56B
MD5

c943869c5f5ada3a54dcbdbab5534f0d
SHA1

7da129bb7eab9d9616adf59107b456f90d50e59c
SHA256

b1af7bd278739a9c461465a9022f90a4af14ab307edc17d7c02e52a22fffa6a7
SHA512

7bc0bbd32575bfb60e7d6ad9481c6d99435f1470a774bd713cd33b53476ed115b1d50fda31d970423408a7d46438f7fba65b1804de325e1b67a1dfa402502332

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2016	2272	cmd.exe	31
PID 2272 wrote to memory of 2016	2272	cmd.exe	31
PID 2272 wrote to memory of 2016	2272	cmd.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\task_stop.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\schtasks.exe
  schtasks /End /TN winws1
  2⤵
  PID:2016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact