92b9dbef2c0414a2e5f09e2a419a80ba9feb628761a6b07d14fb885b2fa22b60

Analysis

max time kernel
110s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.2MB
Sample231004-sdvz9scf61
SHA256 92b9dbef2c0414a2e5f09e2a419a80ba9feb628761a6b07d14fb885b2fa22b60
MD5 6a89ffb7a507b6eebf6ec8d7635f6a24
SHA1 63e1e227e56d71b28a4e3ddee623986d98b92a72
SHA512 ddccc7028e469518d2f6c16d70a0f4e4d504135738e0678783fda0b349c22e22a57012e2ad3a4564b93429a5743b8869e3de54c446c9dc800df22544808d02d5
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	JQSZY.exe

Executes dropped EXE 1 IoCs

pid	Process
1832	JQSZY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4808	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1300	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1832	JQSZY.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	file.exe
Token: SeDebugPrivilege	1832	JQSZY.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1696	3600	file.exe	96
PID 3600 wrote to memory of 1696	3600	file.exe	96
PID 1696 wrote to memory of 1300	1696	cmd.exe	98
PID 1696 wrote to memory of 1300	1696	cmd.exe	98
PID 1696 wrote to memory of 1832	1696	cmd.exe	99
PID 1696 wrote to memory of 1832	1696	cmd.exe	99
PID 1832 wrote to memory of 4432	1832	JQSZY.exe	103
PID 1832 wrote to memory of 4432	1832	JQSZY.exe	103
PID 4432 wrote to memory of 4808	4432	cmd.exe	105
PID 4432 wrote to memory of 4808	4432	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1519.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1300
- - C:\ProgramData\x64netJS\JQSZY.exe
    "C:\ProgramData\x64netJS\JQSZY.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JQSZY" /tr "C:\ProgramData\x64netJS\JQSZY.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 788.0MB
SHA256 df75cfed934deadfbf7984def5e0f7c77fa3b3a883ab7553b20c0ac2e30f7636
MD5 41b9c73d1b68dc6aad2d14c6e52c98df
SHA1 4053c1198ef897fff810a8fbe53991e084c547e5
SHA512 c47c060729e5efd5632fff60a39964214cf513e438e3caee083288172dd28a61529889914f98f97b2d5b6c1bf92c88964fb9777bc93ecf4754a1f4980f5acc21
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQSZY.exe

Path C:\ProgramData\x64netJS\JQSZY.exe
Size 788.0MB
SHA256 df75cfed934deadfbf7984def5e0f7c77fa3b3a883ab7553b20c0ac2e30f7636
MD5 41b9c73d1b68dc6aad2d14c6e52c98df
SHA1 4053c1198ef897fff810a8fbe53991e084c547e5
SHA512 c47c060729e5efd5632fff60a39964214cf513e438e3caee083288172dd28a61529889914f98f97b2d5b6c1bf92c88964fb9777bc93ecf4754a1f4980f5acc21
SSDEEP 24576:AZO7/OchxtGgIbpCe5LXsRa4ug9FG8jfqWdwo86FWbbb:cO7PTIsexsRa4uibjf/dw7lbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1519.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1519.tmp.bat
Size 142B
SHA256 df1e6ac94a453f1633b920177942921c6d7f5f899db0135cfd6b827b6b3a12c1
MD5 05a1e19e5d810aec348cb542720270c7
SHA1 71f2a96c28cf45b5d5d78fcf3319b884c653c984
SHA512 f4115e0d247742a3eaec3f889ae9121e125704fef58a93a976d4ac06bb1a5232e286d73c4a1437a8f4a8a07a87425891977d4248e5a41b32ac79e9f8b5fc774b
MD5 SHA1 SHA512

Submit Download

memory/1832-20-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/1832-17-0x00007FFC1BAA0000-0x00007FFC1C561000-memory.dmp

Download

memory/1832-18-0x00007FFC1BAA0000-0x00007FFC1C561000-memory.dmp

Download

memory/1832-19-0x000000001B330000-0x000000001B340000-memory.dmp

Download

memory/1832-23-0x000000001B330000-0x000000001B340000-memory.dmp

Download

memory/1832-24-0x00007FFC1BAA0000-0x00007FFC1C561000-memory.dmp

Download

memory/3600-5-0x00007FFC1C710000-0x00007FFC1D1D1000-memory.dmp

Download

memory/3600-6-0x000000001BD50000-0x000000001BD60000-memory.dmp

Download

memory/3600-12-0x00007FFC1C710000-0x00007FFC1D1D1000-memory.dmp

Download

memory/3600-2-0x000000001BD50000-0x000000001BD60000-memory.dmp

Download

memory/3600-3-0x00000000018F0000-0x00000000018F1000-memory.dmp

Download

memory/3600-1-0x00007FFC1C710000-0x00007FFC1D1D1000-memory.dmp

Download

memory/3600-0-0x0000000000F10000-0x0000000001144000-memory.dmp

Download