Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
04/07/2026, 12:17
General
- Target Jindai_Installer.exe
- Size 11.7MB
- Sample260704-pgdnlsa15l
- SHA256 e1afd23f56cd7e18539e3f68d50d16a0d2e81d7cf9254258c82dd2b7a0301051
Malware Config
Signatures
- Loads dropped DLL 18 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jindai_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Jindai_Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jindai_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Jindai_Installer.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference='Continue' function Norm($s){ if($null -eq $s){return ''}; $t=($s.ToString()).Trim(); $bad=@('','default string','to be filled by o.e.m.','to be filled by o.e.m','none','null','na','n/a','0','00000000-0000-0000-0000-000000000000','ffffffff-ffff-ffff-ffff-ffffffffffff','0123456789','system serial number','system product name','system manufacturer','system version','not specified','not applicable','chassis serial number','oem'); if($bad -contains $t.ToLower()){return ''}else{return $t}} $sysProd=Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object -First 1 $mobo=Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object -First 1 $uuid=if($sysProd){Norm($sysProd.UUID)}else{''} $board=if($mobo){Norm($mobo.SerialNumber)}else{''} $mguid='' try{ $mguid=Norm((Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography' -Name MachineGuid -ErrorAction Stop).MachineGuid) }catch{} if(-not ($uuid -or $board -or $mguid)){ exit 1 } function Part($v,$tag){ if($v){return $tag+':'+$v}else{return $tag+':(missing)'} } $combined=(Part $uuid 'U')+'|'+(Part $board 'B')+'|'+(Part $mguid 'M') $bytes=[System.Text.Encoding]::UTF8.GetBytes($combined) $hash=[System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes) $hex=-join ($hash | ForEach-Object { $_.ToString('x2') }) Write-Output $hex.Substring(0,24) "3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
button.tcl
cursors.tcl
fonts.tcl
menubutton.tcl
scale.tcl
scrollbar.tcl
ttk.tcl
utils.tcl
_tkinter.pyd
base_library.zip
cacert.pem
libcrypto-3.dll
libssl-3.dll
python313.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
ucrtbase.dll
zlib1.dll
__PSScriptPolicyTest_dy0amwmu.hxs.ps1
memory/5464-1060-0x00000248748C0000-0x00000248748E2000-memory.dmp
memory/5464-1074-0x00000248752D0000-0x0000024875382000-memory.dmp
memory/5464-1053-0x00007FFBC271F000-0x00007FFBC2720000-memory.dmp
memory/5464-1062-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1063-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1064-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1065-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1066-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1073-0x0000024874DD0000-0x0000024874DEE000-memory.dmp
memory/5464-1059-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1075-0x0000024874DF0000-0x0000024874DFA000-memory.dmp
memory/5464-1076-0x0000024875060000-0x000002487508A000-memory.dmp
memory/5464-1077-0x0000024875060000-0x0000024875084000-memory.dmp
memory/5464-1078-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1080-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/5464-1081-0x00007FFBC2590000-0x00007FFBC2F34000-memory.dmp
memory/6504-1082-0x00007FFBD5C80000-0x00007FFBD5CA9000-memory.dmp