129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

5

zapret-winws/1.cmd

windows7-x64

5

zapret-winws/1.cmd

windows10-2004-x64

5

zapret-winws/2.cmd

windows7-x64

5

zapret-winws/2.cmd

windows10-2004-x64

5

zapret-win...rt.dll

windows7-x64

1

zapret-win...rt.dll

windows10-2004-x64

1

zapret-win...64.sys

windows10-2004-x64

1

zapret-winws/all.cmd

windows7-x64

5

zapret-winws/all.cmd

windows10-2004-x64

5

zapret-win...n1.dll

windows7-x64

5

zapret-win...n1.dll

windows10-2004-x64

5

zapret-win...or.vbs

windows7-x64

1

zapret-win...or.vbs

windows10-2004-x64

1

zapret-win...st.cmd

windows7-x64

5

zapret-win...st.cmd

windows10-2004-x64

5

zapret-win...te.cmd

windows7-x64

8

zapret-win...te.cmd

windows10-2004-x64

8

zapret-win...el.cmd

windows7-x64

8

zapret-win...el.cmd

windows10-2004-x64

8

zapret-win...rt.cmd

windows7-x64

4

zapret-win...rt.cmd

windows10-2004-x64

4

zapret-win...op.cmd

windows7-x64

1

zapret-win...op.cmd

windows10-2004-x64

1

zapret-win...te.cmd

windows7-x64

1

zapret-win...te.cmd

windows10-2004-x64

1

zapret-win...ve.cmd

windows7-x64

1

zapret-win...ve.cmd

windows10-2004-x64

1

zapret-win...rt.cmd

windows7-x64

1

zapret-win...rt.cmd

windows10-2004-x64

1

zapret-win...op.cmd

windows7-x64

1

zapret-win...op.cmd

windows10-2004-x64

1

zapret-win...ws.exe

windows7-x64

5

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 15:05

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

zapret-winws/1.cmd

Resource

win7-20240729-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

zapret-winws/1.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

zapret-winws/2.cmd

Resource

win7-20240708-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

zapret-winws/2.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

zapret-winws/WinDivert.dll

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

zapret-winws/WinDivert.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

zapret-winws/WinDivert64.sys

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

zapret-winws/all.cmd

Resource

win7-20240903-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

zapret-winws/all.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

zapret-winws/cygwin1.dll

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

zapret-winws/cygwin1.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

zapret-winws/elevator.vbs

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

zapret-winws/elevator.vbs

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

zapret-winws/preset_russia_autohostlist.cmd

Resource

win7-20240704-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

zapret-winws/preset_russia_autohostlist.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

zapret-winws/service_create.cmd

Resource

win7-20240903-en

evasion execution persistence upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral17

Sample

zapret-winws/service_create.cmd

Resource

win10v2004-20241007-en

evasion execution persistence upx

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral18

Sample

zapret-winws/service_del.cmd

Resource

win7-20240903-en

evasion execution

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

zapret-winws/service_del.cmd

Resource

win10v2004-20241007-en

evasion execution

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

zapret-winws/service_start.cmd

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

zapret-winws/service_start.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

zapret-winws/service_stop.cmd

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

zapret-winws/service_stop.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

zapret-winws/task_create.cmd

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

zapret-winws/task_create.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

zapret-winws/task_remove.cmd

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

zapret-winws/task_remove.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

zapret-winws/task_start.cmd

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

zapret-winws/task_start.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

zapret-winws/task_stop.cmd

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral31

Sample

zapret-winws/task_stop.cmd

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

zapret-winws/winws.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

zapret-winws/WinDivert64.sys
Size

91KB
MD5

89ed5be7ea83c01d0de33d3519944aa5
SHA1

4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA256

8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
SHA512

be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP

1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zapret-winws\WinDivert64.sys
1⤵
PID:1636
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\WinDivert64.sys
  C:\Users\Admin\AppData\Local\Temp\zapret-winws\WinDivert64.sys
  2⤵
  PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2025

Terms | Privacy