bdc4d2839a129e30a0bca2d81fad7a789802e8e28deeb4587a65aa537577c17c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.bat
Size 3KB
Sample261104-xgr51aee25
SHA256 bdc4d2839a129e30a0bca2d81fad7a789802e8e28deeb4587a65aa537577c17c
MD5 40170fcecc2222c13b6a9864a7e4abe9
SHA1 fdc2d8c0a5433fc8b0febf5efc35403978f8a8b3
SHA512 e78b3f002c1d1b3f6d1b21729547cdedb3992af69b9a96058f8b83238f567f6bd9d5056dd4a11a101e73c42947b5e6eeb2cb415fd238caf762d60889d8e2eb14
TLSH
T1F551867BB641833976BE50F9749A6160BB05E44F2B9CEDC0B1F5113CB40C28DA79B64E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com
15	discord.com

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
692	sc.exe
992	sc.exe
556	sc.exe
3660	sc.exe
3740	sc.exe
4108	sc.exe
2792	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4212	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4684	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1060	taskkill.exe

Runs net.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeRestorePrivilege	4784	winws.exe
Token: SeBackupPrivilege	4784	winws.exe
Token: SeDebugPrivilege	4784	winws.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 2988	4212	cmd.exe	86
PID 2988 wrote to memory of 2812	2988	net.exe	87
PID 4212 wrote to memory of 2792	4212	cmd.exe	88
PID 4212 wrote to memory of 692	4212	cmd.exe	89
PID 4212 wrote to memory of 1060	4212	cmd.exe	90
PID 4212 wrote to memory of 992	4212	cmd.exe	92
PID 4212 wrote to memory of 556	4212	cmd.exe	93
PID 4212 wrote to memory of 3660	4212	cmd.exe	94
PID 4212 wrote to memory of 3740	4212	cmd.exe	95
PID 4212 wrote to memory of 4684	4212	cmd.exe	97
PID 4212 wrote to memory of 4108	4212	cmd.exe	102
PID 4212 wrote to memory of 2764	4212	cmd.exe	103
PID 4212 wrote to memory of 4596	4212	cmd.exe	104
PID 4212 wrote to memory of 1580	4212	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2812
- C:\Windows\system32\sc.exe
  sc stop zapret-discord
  2⤵
  - Launches sc.exe
  PID:2792
- C:\Windows\system32\sc.exe
  sc delete zapret-discord
  2⤵
  - Launches sc.exe
  PID:692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im winws.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\system32\sc.exe
  sc create zapret-discord binPath= "\"C:\Users\Admin\AppData\Local\Temp\bin\winws.exe\" --wf-tcp=443,2053,2083,2087,2096,8443 --wf-udp=50000-50099,19294-19344 --filter-tcp=443 --hostlist=C:\Users\Admin\AppData\Local\Temp\lists\discord-hosts.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=md5sig --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist=C:\Users\Admin\AppData\Local\Temp\lists\discord-hosts.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=md5sig --dpi-desync-repeats=6 --new --filter-udp=50000-50099 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-udp=19294-19344 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6" DisplayName= "zapret: Discord only" start= auto
  2⤵
  - Launches sc.exe
  PID:992
- C:\Windows\system32\sc.exe
  sc description zapret-discord "Local DPI bypass for Discord only (winws + WinDivert)"
  2⤵
  - Launches sc.exe
  PID:556
- C:\Windows\system32\sc.exe
  sc failure zapret-discord reset= 86400 actions= restart/1000/restart/2000/restart/5000
  2⤵
  - Launches sc.exe
  PID:3660
- C:\Windows\system32\sc.exe
  sc start zapret-discord
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:4684
- C:\Windows\system32\sc.exe
  sc query zapret-discord
  2⤵
  - Launches sc.exe
  PID:4108
- C:\Windows\system32\findstr.exe
  findstr /i "RUNNING"
  2⤵
  PID:2764
- C:\Windows\system32\curl.exe
  curl.exe -s -o NUL -m 10 -w " discord.com/api -> HTTP %{http_code} (want 200)\n" https://discord.com/api/v9/gateway
  2⤵
  PID:4596
- C:\Windows\system32\curl.exe
  curl.exe -s -o NUL -m 10 -w " discord.com -> HTTP %{http_code} (want 200)\n" https://discord.com/
  2⤵
  PID:1580

C:\Users\Admin\AppData\Local\Temp\bin\winws.exe
"C:\Users\Admin\AppData\Local\Temp\bin\winws.exe" --wf-tcp=443,2053,2083,2087,2096,8443 --wf-udp=50000-50099,19294-19344 --filter-tcp=443 --hostlist=C:\Users\Admin\AppData\Local\Temp\lists\discord-hosts.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=md5sig --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist=C:\Users\Admin\AppData\Local\Temp\lists\discord-hosts.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=md5sig --dpi-desync-repeats=6 --new --filter-udp=50000-50099 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-udp=19294-19344 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\bin\WinDivert64.sys
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4784-0-0x0000000100400000-0x000000010043D000-memory.dmp

Download

memory/4784-1-0x00007FFB868E0000-0x00007FFB86BE2000-memory.dmp

Download

memory/4784-5-0x00007FFB868E0000-0x00007FFB86BE2000-memory.dmp

Download

memory/4784-3-0x0000000052480000-0x0000000052493000-memory.dmp

Download

memory/4784-2-0x0000000100400000-0x000000010043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads