Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 10:50
General
- Target start-fake-only.bat
- Size 2KB
- Sample261027-mxff2adc64
- SHA256 148baa8af294c6099072bd3ef49543978f61169eacd7ce9b31622457c1fb62d1
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start-fake-only.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq winws.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "winws.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe"C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe" "--wf-tcp-out" "80,443,2053,2083,2087,2096,8443" "--wf-udp-out" "443,19294-19344,50000-50100,4192" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-lib.lua" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-antidpi.lua" "--blob" "google_tls:@C:\Users\Admin\AppData\Local\Temp\blobs\tls_clienthello_www_google_com.bin" "--blob" "quic_google:@C:\Users\Admin\AppData\Local\Temp\blobs\quic_initial_www_google_com.bin" "--lua-gc" "60" "--filter-udp" "19294-19344,50000-50100" "--filter-l7" "discord,stun" "--payload" "discord_ip_discovery" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=7" "--new" "--filter-tcp" "2053,2083,2087,2096,8443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=7" "--new" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=6" "--new" "--filter-tcp" "80,443" "--filter-l7" "tls,http" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--payload" "tls_client_hello,http_req" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=6" "--new" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-udp=4192" "--ipset=C:\Users\Admin\AppData\Local\Temp\lists\games\_POOL_~1.TXT" "--out-range" "-d4" "--lua-desync=fake:blob=quic_google:repeats=1:payload=all"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sysC:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/624-1-0x00007FFA13690000-0x00007FFA13992000-memory.dmp
memory/624-0-0x00007FF608A80000-0x00007FF608B25000-memory.dmp
memory/624-5-0x00007FFA13690000-0x00007FFA13992000-memory.dmp
memory/624-4-0x000000006C600000-0x000000006C613000-memory.dmp
memory/624-2-0x00007FF608A80000-0x00007FF608B25000-memory.dmp