92b9dbef2c0414a2e5f09e2a419a80ba9feb628761a6b07d14fb885b2fa22b60

Analysis

max time kernel
86s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.2MB
Sample231004-sdvz9scf61
SHA256 92b9dbef2c0414a2e5f09e2a419a80ba9feb628761a6b07d14fb885b2fa22b60
MD5 6a89ffb7a507b6eebf6ec8d7635f6a24
SHA1 63e1e227e56d71b28a4e3ddee623986d98b92a72
SHA512 ddccc7028e469518d2f6c16d70a0f4e4d504135738e0678783fda0b349c22e22a57012e2ad3a4564b93429a5743b8869e3de54c446c9dc800df22544808d02d5
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2688	JQSZY.exe

Loads dropped DLL 2 IoCs

pid	Process
2764	cmd.exe
2764	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2492	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2632	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	file.exe
Token: SeDebugPrivilege	2688	JQSZY.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2764	2816	file.exe	28
PID 2816 wrote to memory of 2764	2816	file.exe	28
PID 2816 wrote to memory of 2764	2816	file.exe	28
PID 2764 wrote to memory of 2632	2764	cmd.exe	30
PID 2764 wrote to memory of 2632	2764	cmd.exe	30
PID 2764 wrote to memory of 2632	2764	cmd.exe	30
PID 2764 wrote to memory of 2688	2764	cmd.exe	31
PID 2764 wrote to memory of 2688	2764	cmd.exe	31
PID 2764 wrote to memory of 2688	2764	cmd.exe	31
PID 2688 wrote to memory of 2676	2688	JQSZY.exe	34
PID 2688 wrote to memory of 2676	2688	JQSZY.exe	34
PID 2688 wrote to memory of 2676	2688	JQSZY.exe	34
PID 2676 wrote to memory of 2492	2676	cmd.exe	36
PID 2676 wrote to memory of 2492	2676	cmd.exe	36
PID 2676 wrote to memory of 2492	2676	cmd.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA16D.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2632
- - C:\ProgramData\x64netJS\JQSZY.exe
    "C:\ProgramData\x64netJS\JQSZY.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 461.5MB
SHA256 9d19d88d7cadf3c8f39c7b8559faab66fc40035d5307c9ebf570870dc47f4104
MD5 3edb122deecc3c25f0cbae31d22c0662
SHA1 4b526e9dbf640b3a0c68d17b66c5905350aaa246
SHA512 b11b13eeb46bfa30b8254be4b5ce9a8db09e0fcee872e9a5d85365ee9141072731d877d2c0fa164cfdb12ec667787db35adab3af92651a93d60bc14d48cbea39
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 439.2MB
SHA256 1b19226051819ee2a91831f52d9b6b64ce491ae8c9a9461081865979e10b9796
MD5 8839db8ab992cbbc744ef2f3972dd272
SHA1 c2281aa6b36d2367332c19772ea74a25febec88f
SHA512 889d46556bee2363da7389cec1ea5202301e9f51a607bc1367b7a9f01da4f0c58b4281662214e47e23aac553442eb3ad89b1a31a10e21fd9bd364bb2879dd4ce
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpA16D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA16D.tmp.bat
Size 142B
SHA256 a08b2e15d04fee9b22f90dd7c112decc98b408a37e8354933d2f43da68003971
MD5 9fbb4208e03cff5cdafc115b6559011f
SHA1 96512062ab1ebd0cb0601d37ef497094097f4c51
SHA512 a2f21a5c3e3252a305cdf7228f1fe56f049ad4a04877d1a0df451111bf86b9311eb7a2267aeec5339abf93412b7898583a3aad54dd20fbc08815abb31d79bfd9
MD5 SHA1 SHA512

Submit Download

tmpA16D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA16D.tmp.bat
Size 142B
SHA256 a08b2e15d04fee9b22f90dd7c112decc98b408a37e8354933d2f43da68003971
MD5 9fbb4208e03cff5cdafc115b6559011f
SHA1 96512062ab1ebd0cb0601d37ef497094097f4c51
SHA512 a2f21a5c3e3252a305cdf7228f1fe56f049ad4a04877d1a0df451111bf86b9311eb7a2267aeec5339abf93412b7898583a3aad54dd20fbc08815abb31d79bfd9
MD5 SHA1 SHA512

Submit Download

JQSZY.exe

Path \ProgramData\x64netJS\JQSZY.exe
Size 435.9MB
SHA256 472ef3dcf2ad8773a8af44a7579920e2aac5868993e341ce03df840a8fdc7ffa
MD5 b983aa8759ac83da21280cf031f7ead1
SHA1 b1ffb914177f08678551fcebaf7fb662e8bb5b25
SHA512 858e5ca036cd014038d6ce602c98d1b99b16e13082131c09daa14e40aa5b3ac76389619d808a98bfa54acf4338d270fe078d2b731758fae98b8f7cf100ef9682
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQSZY.exe

Path \ProgramData\x64netJS\JQSZY.exe
Size 458.8MB
SHA256 96e3c92e443936bce0788133a0c57f3fdc7848e062ca4fb7ebc5d39a13b42a9c
MD5 2f9cc99dd99ba56ec391e0cea71b9b62
SHA1 0f1aeb6fce42412504e3790e4da737c639e77a8e
SHA512 f6ec51debf63f9599af73a0d4fcf19f9fb1e7815cd404ada611a5685165853b27ef8f8c6c12ae58ee28bcb2c70cbb2a5a80b25e87e1acd733646c3172c24faf1
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2688-24-0x000000001B6F0000-0x000000001B770000-memory.dmp

Download

memory/2688-25-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2688-30-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Download

memory/2688-29-0x000000001B6F0000-0x000000001B770000-memory.dmp

Download

memory/2688-26-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Download

memory/2688-22-0x0000000001220000-0x0000000001454000-memory.dmp

Download

memory/2688-23-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Download

memory/2816-1-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Download

memory/2816-2-0x000000001B570000-0x000000001B5F0000-memory.dmp

Download

memory/2816-0-0x00000000009C0000-0x0000000000BF4000-memory.dmp

Download

memory/2816-6-0x000000001B570000-0x000000001B5F0000-memory.dmp

Download

memory/2816-3-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2816-5-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Download

memory/2816-17-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads