Overview

overview

8

Static

static

3

rzmong new.exe

windows10-2004-x64

8

rzmong new.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/05/2026, 20:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    rzmong new.exe
  • Size 52KB
  • Sample260517-yxtjfagv6l
  • SHA256 d0855e441ece7d465f33e3ee2badff6ece8c25ade9c824ef13dc94d8cd37eaed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 2 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\rzmong new.exe
    "C:\Users\Admin\AppData\Local\Temp\rzmong new.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5004
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4712
    • C:\Windows\system32\ie4uinit.exe
      "C:\Windows\system32\ie4uinit.exe" -show
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:4572
    • C:\Windows\system32\ie4uinit.exe
      "C:\Windows\system32\ie4uinit.exe" -ClearIconCache
      2⤵
        PID:3736
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" -change -monitor-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:3444
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" -change -standby-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:3216
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3548
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2088

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_3infv3g1.ptw.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3infv3g1.ptw.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3548-90-0x00000220FCCA0000-0x00000220FCCC0000-memory.dmp
          Download

          memory/3548-85-0x00000221FE140000-0x00000221FE160000-memory.dmp
          Download

          memory/3548-180-0x00000218A04A0000-0x00000218A05A0000-memory.dmp
          Download

          memory/3548-29-0x00000220EA640000-0x00000220EA740000-memory.dmp
          Download

          memory/3548-30-0x00000220EA640000-0x00000220EA740000-memory.dmp
          Download

          memory/3548-36-0x00000218EA270000-0x00000218EA370000-memory.dmp
          Download

          memory/3548-78-0x00000220FE000000-0x00000220FE020000-memory.dmp
          Download

          memory/3548-126-0x00000220FC800000-0x00000220FC900000-memory.dmp
          Download

          memory/3548-105-0x00000221FF600000-0x00000221FF700000-memory.dmp
          Download

          memory/3548-91-0x00000221FE780000-0x00000221FE7A0000-memory.dmp
          Download

          memory/5004-0-0x0000000000C90000-0x0000000000CA4000-memory.dmp
          Download

          memory/5004-7-0x000000001CF20000-0x000000001CF30000-memory.dmp
          Download

          memory/5004-8-0x000000001D370000-0x000000001D392000-memory.dmp
          Download

          memory/5004-258-0x000000001CF20000-0x000000001CF30000-memory.dmp
          Download