129858d6b84c33ddb57b913f236d6e3e4e282233b2724cfc35b381788cc1eba2

Analysis

max time kernel
96s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 15:05

Target

zapret-winws/all.cmd
Size

664B
MD5

10ef318b18f1976e3d3b6f9a3b1879bf
SHA1

50afa980ceb0b66be5d4a86ce2f7f9a942c0084a
SHA256

22919cc412fb8a9778a9152b2323504535a686d94d8a78c8fd17c9917b57f321
SHA512

fd2b0c85ae995cb03af2a79634ab0ba20295f8565e2d7db713e24921c7dcfecf0bb35db570b532a89288c61cc9c58075de541d352c05471009434232694ae338

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/memory/1176-0-0x00007FFDC0C90000-0x00007FFDC0FA2000-memory.dmp	upx
behavioral9/memory/1176-3-0x00007FFDC0C90000-0x00007FFDC0FA2000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1176	4420	cmd.exe	84
PID 4420 wrote to memory of 1176	4420	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-winws\all.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-winws\winws.exe" --wf-tcp=443-65535 --wf-udp=443-65535 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-winws\quic_initial_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-winws\list-youtube.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-winws\tls_clienthello_www_google_com.bin"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1176

memory/1176-0-0x00007FFDC0C90000-0x00007FFDC0FA2000-memory.dmp

Filesize
3.1MB

Download
memory/1176-1-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download
memory/1176-3-0x00007FFDC0C90000-0x00007FFDC0FA2000-memory.dmp

Filesize
3.1MB

Download
memory/1176-4-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/1176-2-0x0000000100400000-0x0000000100446000-memory.dmp

Filesize
280KB

Download