Analysis date (UTC): 13 January 2025, 17:13Analysis environment: Windows 10 Pro, build 19045, x64

https://github.com/censorliber/zapret/releases/download/6.4.2/zapret6.4.2.zip

MD5:0A33B2A632E44C647FD2BE0250676439

SHA1:033B978B84D408F1ECE5F8C2F3BBDBED7D5F2128

SHA256:6F4FAC6C14E325262B410F4DF667AFDF8D044F382F09B30DD83DE27C5B91B64F

Analysis result

Threat level:Malicious activity

Tags:

telegramarch-execarch-scrarch-docreflectionloader

Full analysis:Analysis https://github.com/censorliber/zapret/releases/download/6.4.2/zapret6.4.2.zip Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes powershell execution policy (Bypass)

WinRAR.exe (PID: 7916)
powershell.exe (PID: 8088)

Bypass execution policy to execute commands

powershell.exe (PID: 8088)
powershell.exe (PID: 4500)
powershell.exe (PID: 7700)

Starts NET.EXE for service management

net.exe (PID: 8288)
cmd.exe (PID: 9052)
net.exe (PID: 1344)
net.exe (PID: 9096)
net.exe (PID: 8204)
cmd.exe (PID: 3152)
net.exe (PID: 3772)
net.exe (PID: 1140)

Changes powershell execution policy (Unrestricted)

cmd.exe (PID: 7476)

SUSPICIOUS

Reads security settings of Internet Explorer

WinRAR.exe (PID: 7916)

Starts POWERSHELL.EXE for commands execution

WinRAR.exe (PID: 7916)
powershell.exe (PID: 8088)
cmd.exe (PID: 8880)
cmd.exe (PID: 7476)
cmd.exe (PID: 8108)

The process executes Powershell scripts

WinRAR.exe (PID: 7916)
powershell.exe (PID: 8088)
cmd.exe (PID: 7476)

Checks a user's role membership (POWERSHELL)

powershell.exe (PID: 8088)
powershell.exe (PID: 4500)

Application launched itself

powershell.exe (PID: 8088)
cmd.exe (PID: 7476)

The process bypasses the loading of PowerShell profile settings

powershell.exe (PID: 8088)

Executable content was dropped or overwritten

powershell.exe (PID: 4500)

Drops a system driver (possible attempt to evade defenses)

powershell.exe (PID: 4500)

Detects reflection assembly loader (YARA)

powershell.exe (PID: 4500)

Starts CMD.EXE for commands execution

WinRAR.exe (PID: 7916)
powershell.exe (PID: 9012)
cmd.exe (PID: 7476)
powershell.exe (PID: 8044)

Executing commands from ".cmd" file

WinRAR.exe (PID: 7916)
powershell.exe (PID: 9012)
powershell.exe (PID: 8044)

Starts application with an unusual extension

cmd.exe (PID: 8880)
cmd.exe (PID: 9052)
cmd.exe (PID: 7476)
cmd.exe (PID: 8108)
cmd.exe (PID: 3152)

Starts process via Powershell

powershell.exe (PID: 9012)
powershell.exe (PID: 8044)

Windows service management via SC.EXE

sc.exe (PID: 2632)
sc.exe (PID: 8812)
sc.exe (PID: 9100)
sc.exe (PID: 8536)
sc.exe (PID: 8156)
sc.exe (PID: 8472)

Starts SC.EXE for service management

cmd.exe (PID: 9052)
cmd.exe (PID: 3152)

Executing commands from a ".bat" file

WinRAR.exe (PID: 7916)

Using 'findstr.exe' to search for text patterns in files and output

cmd.exe (PID: 7476)

INFO

Application launched itself

firefox.exe (PID: 2624)
firefox.exe (PID: 6164)
msedge.exe (PID: 7904)
msedge.exe (PID: 2164)

Manual execution by a user

WinRAR.exe (PID: 7916)
msedge.exe (PID: 2164)

The sample compiled with english language support

firefox.exe (PID: 6164)
powershell.exe (PID: 4500)
msedge.exe (PID: 1544)

Reads Microsoft Office registry keys

WinRAR.exe (PID: 7916)

The process uses the downloaded file

powershell.exe (PID: 8088)
WinRAR.exe (PID: 7916)

Uses string split method (POWERSHELL)

powershell.exe (PID: 4500)

Reads the computer name

identity_helper.exe (PID: 8748)

Checks supported languages

identity_helper.exe (PID: 8748)
chcp.com (PID: 8820)
chcp.com (PID: 1512)
chcp.com (PID: 4972)

The executable file from the user directory is run by the Powershell process

winws.exe (PID: 732)

Attempting to use instant messaging service

msedge.exe (PID: 2356)

Reads Environment values

identity_helper.exe (PID: 8748)

Changes the display of characters in the console

cmd.exe (PID: 8880)
cmd.exe (PID: 9052)
cmd.exe (PID: 7476)
cmd.exe (PID: 8108)
cmd.exe (PID: 3152)

Executable content was dropped or overwritten

firefox.exe (PID: 6164)
msedge.exe (PID: 1544)

Threats

PID	Process	Class	Message
2192	svchost.exe	Potentially Bad Traffic	ET INFO Self-Hosted Git Service Domain in DNS Lookup (gitea .com)
4500	powershell.exe	Potentially Bad Traffic	ET INFO Observed Self-Hosted Git Service Domain (gitea .com in TLS SNI)
2356	msedge.exe	Misc activity	ET INFO Observed Telegram Domain (t .me in TLS SNI)