Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 04:37
General
- Target Jinshan_x64.exe
- Size 13.2MB
- Sample260819-e85lasdn9w
- SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jinshan_x64.exe"C:\Users\Admin\AppData\Local\Temp\Jinshan_x64.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I /C:"360tray.exe" /C:"HipsTray.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\,D:\,F:\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe1⤵
-
C:\Windows\System32\UserAccountBroker.exeC:\Windows\System32\UserAccountBroker.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\edpnotify.exeC:\Windows\System32\edpnotify.exe1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
nsExec.dll
ap.asin
bnymir.ou
bteuns.pt
cmrsk.ce
ev2c34.exe.nhpart_d188f23a30cf
fhkan.oi
dxyvnb.ti
ev2f79.exe
otrm.oi
memory/1432-8-0x0000000002280000-0x00000000022B6000-memory.dmp
memory/1432-14-0x0000000005570000-0x00000000055D6000-memory.dmp
memory/1432-24-0x00000000060B0000-0x00000000060D0000-memory.dmp
memory/1432-21-0x00000000709F0000-0x0000000070A3C000-memory.dmp
memory/1432-25-0x0000000006CF0000-0x0000000006D93000-memory.dmp
memory/1432-26-0x0000000007490000-0x0000000007B0C000-memory.dmp
memory/1432-27-0x0000000006E50000-0x0000000006E6A000-memory.dmp
memory/1432-28-0x0000000006EC0000-0x0000000006ECA000-memory.dmp
memory/1432-29-0x00000000070C0000-0x0000000007156000-memory.dmp
memory/1432-31-0x0000000074050000-0x000000007480C000-memory.dmp
memory/1432-18-0x0000000005AE0000-0x0000000005AFE000-memory.dmp
memory/1432-17-0x00000000055E0000-0x000000000593B000-memory.dmp
memory/1432-19-0x0000000005B20000-0x0000000005B6C000-memory.dmp
memory/1432-12-0x0000000004BF0000-0x0000000004C12000-memory.dmp
memory/1432-9-0x0000000074050000-0x000000007480C000-memory.dmp
memory/1432-10-0x0000000004D40000-0x000000000538A000-memory.dmp
memory/1432-11-0x0000000074050000-0x000000007480C000-memory.dmp
memory/1432-7-0x0000000074062000-0x0000000074063000-memory.dmp
memory/1432-13-0x0000000005500000-0x0000000005566000-memory.dmp
memory/1432-20-0x0000000006CA0000-0x0000000006CD6000-memory.dmp
memory/2216-148-0x0000000180000000-0x000000018008E000-memory.dmp
memory/4132-169-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-166-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-167-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-134-0x0000000180000000-0x000000018008A000-memory.dmp
memory/4132-163-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-164-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-168-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/4132-165-0x0000016C1A3A0000-0x0000016C1A470000-memory.dmp
memory/5592-125-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5592-122-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5592-123-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5592-124-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5592-116-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5592-162-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-65-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-73-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-72-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-77-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-71-0x0000000010000000-0x0000000010032000-memory.dmp
memory/5876-74-0x0000000010000000-0x0000000010032000-memory.dmp
memory/6100-79-0x000001091BE70000-0x000001091BE71000-memory.dmp
memory/6100-78-0x0000010934EC0000-0x0000010935182000-memory.dmp
memory/6100-81-0x000001091BEB0000-0x000001091BECE000-memory.dmp
memory/6100-80-0x000001091C450000-0x000001091C4C6000-memory.dmp