129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 15:05

Target

zapret-winws/all.cmd
Size

664B
MD5

10ef318b18f1976e3d3b6f9a3b1879bf
SHA1

50afa980ceb0b66be5d4a86ce2f7f9a942c0084a
SHA256

22919cc412fb8a9778a9152b2323504535a686d94d8a78c8fd17c9917b57f321
SHA512

fd2b0c85ae995cb03af2a79634ab0ba20295f8565e2d7db713e24921c7dcfecf0bb35db570b532a89288c61cc9c58075de541d352c05471009434232694ae338

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral8/memory/2552-0-0x000007FEF5FD0000-0x000007FEF62E2000-memory.dmp	upx
behavioral8/memory/2552-5-0x000007FEF5FD0000-0x000007FEF62E2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2552	1860	cmd.exe	31
PID 1860 wrote to memory of 2552	1860	cmd.exe	31
PID 1860 wrote to memory of 2552	1860	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\all.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-tcp=443-65535 --wf-udp=443-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-winws\tls_clienthello_www_google_com.bin"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

memory/2552-0-0x000007FEF5FD0000-0x000007FEF62E2000-memory.dmp

Filesize
3.1MB

Download
memory/2552-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2552-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/2552-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/2552-5-0x000007FEF5FD0000-0x000007FEF62E2000-memory.dmp

Filesize
3.1MB

Download