Analysis
- max time kernel
143s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
14/08/2023, 13:30
General
- Target Zjmucwroot.exe
- Size 113KB
- Sample230814-qrtcgscc32
- SHA256 62625b630b5bbcb1052cb0034b60dcf702d96fec3fcfe5cb6154546a06b68634
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zjmucwroot.exe"C:\Users\Admin\AppData\Local\Temp\Zjmucwroot.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell set-mppreference -exclusionpath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e2srfnac.b0p.ps1
memory/1508-1264-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1508-1262-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1508-1265-0x0000000005080000-0x0000000005090000-memory.dmp
memory/1508-1268-0x0000000005080000-0x0000000005090000-memory.dmp
memory/1508-1267-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/1508-1266-0x0000000005DF0000-0x0000000005E40000-memory.dmp
memory/2532-186-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-198-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-138-0x0000000004F80000-0x0000000004F8A000-memory.dmp
memory/2532-139-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-140-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-142-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-144-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-146-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-148-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-150-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-152-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-154-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-156-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-158-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-160-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-162-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-164-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-166-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-168-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-170-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-172-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-174-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-176-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-178-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-180-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-182-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-184-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-136-0x0000000004DE0000-0x0000000004E72000-memory.dmp
memory/2532-188-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-190-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-137-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2532-192-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-133-0x00000000003C0000-0x00000000003E2000-memory.dmp
memory/2532-194-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-200-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-202-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-941-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/2532-1038-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2532-1217-0x0000000006EC0000-0x0000000006EC1000-memory.dmp
memory/2532-1263-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/2532-196-0x00000000077F0000-0x00000000078B5000-memory.dmp
memory/2532-134-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/2532-135-0x00000000052B0000-0x0000000005854000-memory.dmp
memory/3904-1249-0x0000000007690000-0x0000000007D0A000-memory.dmp
memory/3904-1238-0x000000006F490000-0x000000006F4DC000-memory.dmp
memory/3904-1223-0x0000000004D60000-0x0000000004D82000-memory.dmp
memory/3904-1224-0x0000000005000000-0x0000000005066000-memory.dmp
memory/3904-1225-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/3904-1235-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/3904-1236-0x0000000002570000-0x0000000002580000-memory.dmp
memory/3904-1237-0x0000000006D10000-0x0000000006D42000-memory.dmp
memory/3904-1250-0x0000000007050000-0x000000000706A000-memory.dmp
memory/3904-1221-0x0000000002570000-0x0000000002580000-memory.dmp
memory/3904-1222-0x0000000005120000-0x0000000005748000-memory.dmp
memory/3904-1251-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/3904-1248-0x0000000006300000-0x000000000631E000-memory.dmp
memory/3904-1252-0x00000000072D0000-0x0000000007366000-memory.dmp
memory/3904-1220-0x0000000002570000-0x0000000002580000-memory.dmp
memory/3904-1219-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3904-1218-0x0000000000DE0000-0x0000000000E16000-memory.dmp
memory/3904-1253-0x0000000007280000-0x000000000728E000-memory.dmp
memory/3904-1254-0x0000000007390000-0x00000000073AA000-memory.dmp
memory/3904-1255-0x0000000007370000-0x0000000007378000-memory.dmp
memory/3904-1258-0x00000000748B0000-0x0000000075060000-memory.dmp