f1b3e06a2213e52f69b7ff40e0c147ba23d672b92b16a23db65aacbda3cc68b1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shanz.exe
Size 1020KB
Sample240203-qq2mgacgbl
SHA256 f1b3e06a2213e52f69b7ff40e0c147ba23d672b92b16a23db65aacbda3cc68b1
MD5 3a5c4f2fe5be0b67a60f893913b97491
SHA1 7681bed672c00e8fe94aea2afe1aa5a05750990d
SHA512 c1e3f31142b2becf5bf41205159e382b5a00e6194d16b633f5ad25dcd3e11df2ad3923ede35dcd6c996e8d68c4ad4dd5daf680926896f311360bf0d0a8a694d3
SSDEEP 24576:Sny/f9uCzjXbOm1W0STP+2Q89RKvUyDpvjjrRr2GNFlr:XF900STNQTdhpqG7B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4520 created 3336	4520	shanz.exe	54

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	shanz.exe

Executes dropped EXE 1 IoCs

pid	Process
4520	shanz.exe

VMProtect packed file 17 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2072-23-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-31-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-37-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-36-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-35-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-39-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-40-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-41-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-42-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-44-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-43-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-47-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-48-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-49-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-50-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-51-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect
behavioral2/memory/2072-53-0x0000000010000000-0x00000000102D4000-memory.dmp	vmprotect

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 1400	4520	shanz.exe	92
PID 1400 set thread context of 2072	1400	svchost.exe	93

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\shanz	shanz.exe
File created	C:\Program Files (x86)\shanz\__tmp_rar_sfx_access_check_240602406	shanz.exe
File created	C:\Program Files (x86)\shanz\shanz.bat	shanz.exe
File opened for modification	C:\Program Files (x86)\shanz\shanz.bat	shanz.exe
File created	C:\Program Files (x86)\shanz\shanz.exe	shanz.exe
File opened for modification	C:\Program Files (x86)\shanz\shanz.exe	shanz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4520	shanz.exe
4520	shanz.exe
4520	shanz.exe
4520	shanz.exe
4520	shanz.exe
4520	shanz.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	shanz.exe
Token: SeDebugPrivilege	1400	svchost.exe
Token: SeDebugPrivilege	2072	charmap.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3336	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1368	2384	shanz.exe	89
PID 2384 wrote to memory of 1368	2384	shanz.exe	89
PID 2384 wrote to memory of 1368	2384	shanz.exe	89
PID 1368 wrote to memory of 4520	1368	cmd.exe	91
PID 1368 wrote to memory of 4520	1368	cmd.exe	91
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 1400	4520	shanz.exe	92
PID 4520 wrote to memory of 3336	4520	shanz.exe	54
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93
PID 1400 wrote to memory of 2072	1400	svchost.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3336
- C:\Users\Admin\AppData\Local\Temp\shanz.exe
  "C:\Users\Admin\AppData\Local\Temp\shanz.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\shanz\shanz.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Program Files (x86)\shanz\shanz.exe
      shanz.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4520
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetwork -p
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\charmap.exe
    C:\Windows\SysWOW64\charmap.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shanz.bat

Path C:\Program Files (x86)\shanz\shanz.bat
Size 53B
SHA256 03b1c7222bd38d52882be6698887c900cd1665b54166781dd4d8f32026a2808b
MD5 ef19d95864bd101866b24f84be1c48ea
SHA1 4956fe828d3efd81101d6913753ed7d15698ae7b
SHA512 911718b55c21d4d2a71b2127a2c5787f9d0aa1b706afbd469e882ea06b4901931b234fa1ad34ca19bb5415f885ae85f8d4b66c3eafa4d4a3eac9d6680e034ecd
MD5 SHA1 SHA512

Submit Download

shanz.exe

Path C:\Program Files (x86)\shanz\shanz.exe
Size 878KB
SHA256 9331b7f9f0db4a900dc124712af08ccc37a4b3fe66fa37b8fc74ce21fd218fd3
MD5 b74c1f5a5bde0cff37c9420a1ee63a3d
SHA1 d6c3cf229ae6c4015ef5b9b1b7c1878cf9935d49
SHA512 9d167df0c6e62506b04a7eae1f536bcaddb852116ebd0253ed05208f7557da25b07b3ac48475c844e30f646f005fa326ce9da32f738a3bb649fabae5515f7ca9
SSDEEP 24576:IFryu0cXguZV+oM9c3rKmYsCgnAxXsHmh2EUa:IdyuRg8gurKbgnABsHmh2K
MD5 SHA1 SHA512 SSDEEP

Submit Download

shanz.exe

Path C:\Program Files (x86)\shanz\shanz.exe
Size 957KB
SHA256 a6f964052ad80759fb2cc5cda4b30efc2ff1225c94082ef90b97e1bd52d7c732
MD5 b97df8035843cfe15701a1856fef50b0
SHA1 4a2491b5c43f39732ea09e8951eceaf14e29d505
SHA512 77fe5b52d7253bd8fdbe3d2ce74f3381e25451753314855ebc45bade4f9537462372d90da7dd9dd24b2773b8072eb7106b01c3eabcd6bb0a128bd14d64704dd5
SSDEEP 24576:IFryu0cXguZV+oM9c3rKmYsCgnAxXsHmh2EUWEG1Z:IdyuRg8gurKbgnABsHmh2GEG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-18-0x0000000180000000-0x00000001800F0000-memory.dmp

Download

memory/1400-10-0x0000023EB9AD0000-0x0000023EB9BD1000-memory.dmp

Download

memory/1400-12-0x0000000180000000-0x00000001800F0000-memory.dmp

Download

memory/2072-35-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-41-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-23-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-31-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-37-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-36-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-53-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-39-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-40-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-21-0x00000000005F0000-0x00000000006BE000-memory.dmp

Download

memory/2072-42-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-44-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-43-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-47-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-48-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-49-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-50-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/2072-51-0x0000000010000000-0x00000000102D4000-memory.dmp

Download

memory/3336-19-0x0000000003190000-0x0000000003191000-memory.dmp

Download