Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/08/2026, 04:37
General
- Target Jinshan_x64.exe
- Size 13.2MB
- Sample260819-e85lasdn9w
- SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jinshan_x64.exe"C:\Users\Admin\AppData\Local\Temp\Jinshan_x64.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I /C:"360tray.exe" /C:"HipsTray.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\,D:\,F:\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe1⤵
-
C:\Windows\System32\UserAccountBroker.exeC:\Windows\System32\UserAccountBroker.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\edpnotify.exeC:\Windows\System32\edpnotify.exe1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_iqzrnocp.z0r.ps1
System.dll
nsExec.dll
ap.asin
bnymir.ou
bteuns.pt
cmrsk.ce
ev2c34.exe
fhkan.oi
dxyvnb.ti
ev2f79.exe
otrm.oi
memory/1056-93-0x0000021FC06D0000-0x0000021FC06EE000-memory.dmp
memory/1056-92-0x0000021FD90B0000-0x0000021FD9126000-memory.dmp
memory/1056-91-0x0000021FC06A0000-0x0000021FC06A1000-memory.dmp
memory/1056-90-0x0000021FD9200000-0x0000021FD94C2000-memory.dmp
memory/1080-136-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1080-135-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1080-134-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1080-133-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1080-127-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1080-176-0x0000000010000000-0x0000000010032000-memory.dmp
memory/2340-33-0x0000000006D10000-0x0000000006DB3000-memory.dmp
memory/2340-22-0x0000000005B20000-0x0000000005B6C000-memory.dmp
memory/2340-41-0x0000000007160000-0x000000000717A000-memory.dmp
memory/2340-40-0x0000000007050000-0x0000000007064000-memory.dmp
memory/2340-7-0x0000000000D90000-0x0000000000DA0000-memory.dmp
memory/2340-8-0x0000000000DA0000-0x0000000000DD6000-memory.dmp
memory/2340-9-0x0000000004DA0000-0x00000000053C8000-memory.dmp
memory/2340-10-0x0000000004B30000-0x0000000004B52000-memory.dmp
memory/2340-11-0x0000000005440000-0x00000000054A6000-memory.dmp
memory/2340-39-0x0000000007040000-0x000000000704E000-memory.dmp
memory/2340-38-0x0000000007010000-0x0000000007021000-memory.dmp
memory/2340-12-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/2340-37-0x00000000070A0000-0x0000000007136000-memory.dmp
memory/2340-36-0x0000000006E80000-0x0000000006E8A000-memory.dmp
memory/2340-34-0x0000000007460000-0x0000000007ADA000-memory.dmp
memory/2340-35-0x0000000006E10000-0x0000000006E2A000-memory.dmp
memory/2340-32-0x00000000060A0000-0x00000000060BE000-memory.dmp
memory/2340-24-0x0000000070990000-0x00000000709DC000-memory.dmp
memory/2340-23-0x0000000006CD0000-0x0000000006D02000-memory.dmp
memory/2340-42-0x0000000007090000-0x0000000007098000-memory.dmp
memory/2340-21-0x0000000005AF0000-0x0000000005B0E000-memory.dmp
memory/2340-18-0x0000000005520000-0x0000000005874000-memory.dmp
memory/2844-177-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-178-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-179-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-182-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-147-0x0000000180000000-0x000000018008A000-memory.dmp
memory/2844-183-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-181-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2844-180-0x000001D67FC30000-0x000001D67FD00000-memory.dmp
memory/2896-162-0x0000000180000000-0x000000018008E000-memory.dmp
memory/3500-86-0x0000000010000000-0x0000000010032000-memory.dmp
memory/3500-89-0x0000000010000000-0x0000000010032000-memory.dmp
memory/3500-85-0x0000000010000000-0x0000000010032000-memory.dmp
memory/3500-84-0x0000000010000000-0x0000000010032000-memory.dmp
memory/3500-83-0x0000000010000000-0x0000000010032000-memory.dmp
memory/3500-77-0x0000000010000000-0x0000000010032000-memory.dmp