Overview
overview
7Static
static
3bin/WinDivert.dll
windows10-2004-x64
1bin/WinDivert.dll
windows11-ltsc_2024-x64
1bin/WinDivert64.sys
windows10-2004-x64
3bin/cygwin1.dll
windows10-2004-x64
1bin/cygwin1.dll
windows11-ltsc_2024-x64
1bin/winws2.exe
windows10-2004-x64
1bin/winws2.exe
windows11-ltsc_2024-x64
1lua/zapret-auto.bat
windows10-2004-x64
3lua/zapret-auto.bat
windows11-ltsc_2024-x64
3lua/zapret-lib.bat
windows10-2004-x64
3lua/zapret-lib.bat
windows11-ltsc_2024-x64
3lua/zapret-tests.bat
windows10-2004-x64
3lua/zapret-tests.bat
windows11-ltsc_2024-x64
3service-install.bat
windows10-2004-x64
7service-install.bat
windows11-ltsc_2024-x64
7service-remove.bat
windows10-2004-x64
7service-remove.bat
windows11-ltsc_2024-x64
7service.bat
windows10-2004-x64
3service.bat
windows11-ltsc_2024-x64
3start-auto.bat
windows10-2004-x64
5start-auto.bat
windows11-ltsc_2024-x64
5start-default-alt.bat
windows10-2004-x64
5start-default-alt.bat
windows11-ltsc_2024-x64
5start-default.bat
windows10-2004-x64
5start-default.bat
windows11-ltsc_2024-x64
5start-fake...er.bat
windows10-2004-x64
5start-fake...er.bat
windows11-ltsc_2024-x64
5start-fake...er.bat
windows10-2004-x64
5start-fake...er.bat
windows11-ltsc_2024-x64
5start-fake-only.bat
windows10-2004-x64
5start-fake-only.bat
windows11-ltsc_2024-x64
5start-fakedsplit.bat
windows10-2004-x64
5Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
bin/WinDivert.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
bin/WinDivert.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
bin/WinDivert64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
bin/cygwin1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
bin/cygwin1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral6
Sample
bin/winws2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
bin/winws2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral8
Sample
lua/zapret-auto.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
lua/zapret-auto.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
lua/zapret-lib.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
lua/zapret-lib.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
lua/zapret-tests.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
lua/zapret-tests.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral14
Sample
service-install.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
service-install.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
service-remove.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
service-remove.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
service.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
service.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
start-auto.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
start-auto.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
start-default-alt.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
start-default-alt.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
start-default.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
start-default.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
start-fake-disorder.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
start-fake-disorder.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
start-fake-multidisorder.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
start-fake-multidisorder.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
start-fake-only.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
start-fake-only.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target bin/winws2.exe
- Size 641KB
- Sample261027-mxff2adc64
- SHA256 a25355939cbe7f643c8e746c41b38d367600813898385415245b09b565d84c96
- MD5 e61e533024af451053a54bcd5316da55
- SHA1 c1275fbcef43e96481a988cfdb26eb95062e658b
- SHA512 17395b3b4fd88668f58955541aa683aaba77d6ed62ebdd9ea444efe4e09be4cb7e0cb929474dbc2e8b38160055ba409f0014ae6c9a8286527d8044883dae0384
- SSDEEP 12288:G9p2C1FPrqXUb2Qb01NronM/e3MafehBrI1gBrNZM6:u9Nqm2Qb01dQM/xafKh8Wr
- TLSH T185D47C06E2A248BAC46291718B9ED732B731FC491334AB1E3B64F7181F35D605A9F76C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3196 winws2.exe Token: SeBackupPrivilege 3196 winws2.exe Token: SeDebugPrivilege 3196 winws2.exe