Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 10:50
General
- Target start-fakedsplit.bat
- Size 2KB
- Sample261027-mxff2adc64
- SHA256 69e04a8bf615ad06aaeb01eb44070df49d2cdf54580cdf42d00d7d77af882b3a
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start-fakedsplit.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq winws.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\findstr.exefindstr /I "winws.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe"C:\Users\Admin\AppData\Local\Temp\bin\winws2.exe" "--wf-tcp-out" "80,443,2053,2083,2087,2096,8443" "--wf-udp-out" "443,19294-19344,50000-50100,4192" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-lib.lua" "--lua-init=@C:\Users\Admin\AppData\Local\Temp\lua\zapret-antidpi.lua" "--blob" "google_tls:@C:\Users\Admin\AppData\Local\Temp\blobs\tls_clienthello_www_google_com.bin" "--blob" "quic_google:@C:\Users\Admin\AppData\Local\Temp\blobs\quic_initial_www_google_com.bin" "--lua-gc" "60" "--filter-udp" "19294-19344,50000-50100" "--filter-l7" "discord,stun" "--payload" "discord_ip_discovery" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=7" "--lua-desync=fakedsplit:blob=google_tls:pos=2" "--new" "--filter-tcp" "2053,2083,2087,2096,8443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-discord.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=7" "--lua-desync=multisplit:pos=1:seqovl=681:seqovl_pattern=google_tls" "--new" "--filter-tcp" "443" "--filter-l7" "tls" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--payload" "tls_client_hello" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:repeats=6" "--lua-desync=fakedsplit:blob=google_tls:pos=2" "--new" "--filter-tcp" "80,443" "--filter-l7" "tls,http" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--payload" "tls_client_hello,http_req" "--lua-desync=fake:blob=google_tls:tcp_ts=-1000:nodrop" "--lua-desync=fakedsplit:blob=google_tls:pos=2" "--new" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-google.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-udp" "443" "--filter-l7" "quic" "--payload" "quic_initial" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\LIST-E~1.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\LIST-I~2.TXT" "--hostlist=C:\Users\Admin\AppData\Local\Temp\lists\list-general.txt" "--hostlist-exclude=C:\Users\Admin\AppData\Local\Temp\lists\list-exclude.txt" "--out-range" "-d10" "--lua-desync=fake:blob=quic_google" "--new" "--filter-udp=4192" "--ipset=C:\Users\Admin\AppData\Local\Temp\lists\games\_POOL_~1.TXT" "--out-range" "-d4" "--lua-desync=fake:blob=quic_google:repeats=1:payload=all"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sysC:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5808-0-0x00007FF641280000-0x00007FF641325000-memory.dmp
memory/5808-1-0x00007FFDB46F0000-0x00007FFDB49F2000-memory.dmp
memory/5808-2-0x00007FF641280000-0x00007FF641325000-memory.dmp
memory/5808-3-0x0000000073CC0000-0x0000000073CD3000-memory.dmp
memory/5808-5-0x00007FFDB46F0000-0x00007FFDB49F2000-memory.dmp