129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 15:05

Target

zapret-winws/task_stop.cmd
Size

56B
MD5

c943869c5f5ada3a54dcbdbab5534f0d
SHA1

7da129bb7eab9d9616adf59107b456f90d50e59c
SHA256

b1af7bd278739a9c461465a9022f90a4af14ab307edc17d7c02e52a22fffa6a7
SHA512

7bc0bbd32575bfb60e7d6ad9481c6d99435f1470a774bd713cd33b53476ed115b1d50fda31d970423408a7d46438f7fba65b1804de325e1b67a1dfa402502332

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2512	2392	cmd.exe	84
PID 2392 wrote to memory of 2512	2392	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\task_stop.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\schtasks.exe
  schtasks /End /TN winws1
  2⤵
  PID:2512

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact