Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 10:50
General
- Target start-fake-disorder.bat
- Size 2KB
- Sample261027-mxff2adc64
- SHA256 55923229f8749a5de8f73e532dc386acc6c79f2995741398517e87af6da1c58d
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start-fake-disorder.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq winws.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "winws.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe"C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe" "--wf-tcp-out" "80,443,2053,2083,2087,2096,8443" "--wf-udp-out" "443,19294-19344,50000-50100,4192" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-lib.lua" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-antidpi.lua" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-custom.lua" "--blob" "google_tls:@C:\Users\Admin\AppData\Local\Temp\blobs\tls_clienthello_www_google_com.bin" "--blob" "quic_google:@C:\Users\Admin\AppData\Local\Temp\blobs\quic_initial_www_google_com.bin" "--lua-gc" "60" "--filter-udp" "19294-19344,50000-50100" "--filter-l7" "discord,stun" "--payload" "discord_ip_discovery" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-tcp" "2053,2083,2087,2096,8443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=7" "--lua-desync=multisplit:pos=1:seqovl=681:seqovl_pattern=google_tls" "--new" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=tls_fake_disorder:blob=google_tls:fakes=3" "--new" "--name" "gentle_fake_disorder" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=tls_fake_disorder:blob=google_tls:fakes=3" "--new" "--name" "aggressive_fake_disorder" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=tls_fake_disorder:blob=google_tls:fakes=6" "--new" "--name" "quic_google" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--name" "quic_general" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-udp=4192" "--ipset=C:\Users\Admin\AppData\Local\Temp\lists\games\_POOL_~1.TXT" "--out-range" "-d4" "--lua-desync=fake:blob=quic_google:repeats=1:payload=all"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sysC:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2472-0-0x00007FF61C960000-0x00007FF61CA05000-memory.dmp
memory/2472-1-0x00007FFBB9310000-0x00007FFBB9612000-memory.dmp
memory/2472-3-0x0000000066970000-0x0000000066983000-memory.dmp
memory/2472-2-0x00007FF61C960000-0x00007FF61CA05000-memory.dmp
memory/2472-5-0x00007FFBB9310000-0x00007FFBB9612000-memory.dmp