d273d63ec7562e27003ad53db329429452d86faef87b6d64b72875cdb1dd3cee

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.1MB
Sample231002-va38ksch31
SHA256 d273d63ec7562e27003ad53db329429452d86faef87b6d64b72875cdb1dd3cee
MD5 f69d92f2395c1a0ad28dcb02067380d2
SHA1 76191bc5118052a56422945e2bd1903fb0bd6d21
SHA512 8cd5ca4b02ba0dd2755580d9f6590b314aa0570372562bf26931635c27e1c3830beae346df5ed183024b9c6a526c78e59f9b4aa382f8f3e190761e9d709aa24b
SSDEEP 49152:Ohh7AbFDioaQczxmskBDgwDol0sYfRKW2RSYz6TBoLOibbb0Y:wpA5FaplufKqSKP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	JQSZY.exe

Executes dropped EXE 1 IoCs

pid	Process
2164	JQSZY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3980	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3492	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2164	JQSZY.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	file.exe
Token: SeDebugPrivilege	2164	JQSZY.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 3948	1788	file.exe	93
PID 1788 wrote to memory of 3948	1788	file.exe	93
PID 3948 wrote to memory of 3492	3948	cmd.exe	95
PID 3948 wrote to memory of 3492	3948	cmd.exe	95
PID 3948 wrote to memory of 2164	3948	cmd.exe	97
PID 3948 wrote to memory of 2164	3948	cmd.exe	97
PID 2164 wrote to memory of 3380	2164	JQSZY.exe	104
PID 2164 wrote to memory of 3380	2164	JQSZY.exe	104
PID 3380 wrote to memory of 3980	3380	cmd.exe	105
PID 3380 wrote to memory of 3980	3380	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp433E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3492
- - C:\ProgramData\x64netJS\JQSZY.exe
    "C:\ProgramData\x64netJS\JQSZY.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 599.6MB
SHA256 b6bf9cdd53de1ab16e2e69312470054ccfc2327e3406be7d8a161eaa21f304e1
MD5 450ac8c299daaa6c3bc5be87b9e1bcea
SHA1 093a8b3b5c7c866bad7dd3d52ade0d637b406902
SHA512 72806604255fc940285285c25e389d375ee56a7d239607290afc5ad5bd6ae7141bd6eddde2f43e31e3897cac5b0884f947c004f0904c2e2f381c23254396a778
SSDEEP 49152:Ohh7AbFDioaQczxmskBDgwDol0sYfRKW2RSYz6TBoLOibbb0Y:wpA5FaplufKqSKP
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 586.4MB
SHA256 ef104884aa577e1fb304a13f0e0d1b0a7c8f6be0553d91a345d17b964ea6599b
MD5 9b262489137c0f31fa2da717f24c89e8
SHA1 b4e18add70bd1bab6b5c010e85d8cd3953c8fd3d
SHA512 887adbcd2013663438f047502e0bee7059497fc55d20cad35a25d6799536883b195b726cc21b47f0aaf7eb33083b7a6aee2eabfca2bf7bcbd8bf7b084339fedc
SSDEEP 49152:Ohh7AbFDioaQczxmskBDgwDol0sYfRKW2RSYz6TBoLOibbb0Y:wpA5FaplufKqSKP
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp433E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp433E.tmp.bat
Size 142B
SHA256 0f22157e9faf9eebd0901dfbf732cf78b3838a5f2f751cf5121b87c9c3ab71f6
MD5 0293878029740ffe00339f07400a0bfe
SHA1 5bd89c87c9fdb142c4647838758cba5c11352c15
SHA512 0785e17671743343d57e15a445c7532ff7f67718fef085b640fffea8e2c92344567e9abcfbf348f0cf084acec07b20360a370e4ec26046dfdc48a61efcc98ecf
MD5 SHA1 SHA512

Submit Download

memory/1788-4-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download

memory/1788-0-0x00000000009A0000-0x0000000000CB6000-memory.dmp

Download

memory/1788-6-0x000000001C810000-0x000000001C820000-memory.dmp

Download

memory/1788-3-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/1788-13-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download

memory/1788-2-0x000000001C810000-0x000000001C820000-memory.dmp

Download

memory/1788-1-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download

memory/2164-17-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download

memory/2164-19-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Download

memory/2164-18-0x000000001CCC0000-0x000000001CCD0000-memory.dmp

Download

memory/2164-22-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download

memory/2164-23-0x000000001CCC0000-0x000000001CCD0000-memory.dmp

Download

memory/2164-26-0x00007FFC131A0000-0x00007FFC13C61000-memory.dmp

Download