Malware analysis winjizm.exe Malicious activity | ANY.RUN

Add for printing

File name:	winjizm.exe
Full analysis:	https://app.any.run/tasks/4e9c73c8-dbe8-4cad-9da1-25fb8b3363c8
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	April 25, 2019, 10:11:38
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan nemucod loader phorpiex miner
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	C1F2B89C27C0092B0D410C39426A2781
SHA1:	1A2185250D8119A55033AD2148E0D211B9E48127
SHA256:	874D2BF4A81A29158653E24FAB1C52A5503D4939F13232EEAED50A160EF9D87E
SSDEEP:	6144:dl4r60uP40ePNkd2n8zJX2/D2GckUxo9:dqQNePGht2/D9ce

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - 2173339871.exe (PID: 3932)
  - 1677810676.exe (PID: 3088)
  - 4012222297.exe (PID: 580)
  - wingpno.exe (PID: 3608)
- NEMUCOD was detected
  - winjizm.exe (PID: 908)
  - wingpno.exe (PID: 3608)
- Disables Windows System Restore
  - winjizm.exe (PID: 908)
  - wingpno.exe (PID: 3608)
- Disables Windows Defender Real-time monitoring
  - winjizm.exe (PID: 908)
  - wingpno.exe (PID: 3608)
- Changes Security Center notification settings
  - winjizm.exe (PID: 908)
  - wingpno.exe (PID: 3608)
- Downloads executable files from the Internet
  - winjizm.exe (PID: 908)
- Downloads executable files from IP
  - winjizm.exe (PID: 908)
- PHORPIEX was detected
  - 1677810676.exe (PID: 3088)
- Changes the autorun value in the registry
  - 2173339871.exe (PID: 3932)
- MINER was detected
  - wuapp.exe (PID: 2644)
  - wuapp.exe (PID: 3888)
  - wuapp.exe (PID: 3612)
  - wuapp.exe (PID: 2832)
- Writes to a start menu file
  - wscript.exe (PID: 2300)
- Connects to CnC server
  - wuapp.exe (PID: 2644)
  - wuapp.exe (PID: 3888)
  - wuapp.exe (PID: 3612)
  - wuapp.exe (PID: 2832)
SUSPICIOUS
- Executable content was dropped or overwritten
  - winjizm.exe (PID: 908)
  - 2173339871.exe (PID: 3932)
- Creates files in the user directory
  - winjizm.exe (PID: 908)
  - wscript.exe (PID: 2300)
- Starts itself from another location
  - 2173339871.exe (PID: 3932)
- Creates files in the program directory
  - 1677810676.exe (PID: 3088)
- Starts CMD.EXE for commands execution
  - 1677810676.exe (PID: 3088)
- Executes scripts
  - cmd.exe (PID: 588)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (35.8)
.exe	\|	Win64 Executable (generic) (31.7)
.scr	\|	Windows screen saver (15)
.dll	\|	Win32 Dynamic Link Library (generic) (7.5)
.exe	\|	Win32 Executable (generic) (5.1)

EXIF

EXE

Subsystem:	Windows GUI
SubsystemVersion:	5
ImageVersion:	-
OSVersion:	5
EntryPoint:	0xc781
UninitializedDataSize:	-
InitializedDataSize:	532992
CodeSize:	169984
LinkerVersion:	9
PEType:	PE32
TimeStamp:	2018:03:28 00:07:41+02:00
MachineType:	Intel 386 or later, and compatibles

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	27-Mar-2018 22:07:41

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x000000F0

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	5
Time date stamp:	27-Mar-2018 22:07:41
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x000296A3	0x00029800	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.83624
.rdata	0x0002B000	0x000055A0	0x00005600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.31
.data	0x00031000	0x000748F8	0x00008800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	4.73682
.rsrc	0x000A6000	0x00006E48	0x00007000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.25851
.reloc	0x000AD000	0x00001F78	0x00002000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.08585

Imports


ADVAPI32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll

Exports

Title	Ordinal	Address
	214569	0x00000000

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
908	"C:\Users\admin\AppData\Local\Temp\winjizm.exe"	C:\Users\admin\AppData\Local\Temp\winjizm.exe		explorer.exe
User: admin Integrity Level: MEDIUM
3932	C:\Users\admin\AppData\Local\Temp\2173339871.exe	C:\Users\admin\AppData\Local\Temp\2173339871.exe		winjizm.exe
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.11
3088	C:\Users\admin\AppData\Local\Temp\1677810676.exe	C:\Users\admin\AppData\Local\Temp\1677810676.exe		winjizm.exe
User: admin Integrity Level: MEDIUM
3608	C:\Users\admin\3722997311379097\wingpno.exe	C:\Users\admin\3722997311379097\wingpno.exe		2173339871.exe
User: admin Integrity Level: MEDIUM Version: 1.0.0.11
2644	"C:\Windows\System32\wuapp.exe" -c "C:\ProgramData\nEzJvZquBf\cfg"	C:\Windows\System32\wuapp.exe		1677810676.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Update Application Launcher Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
580	C:\Users\admin\AppData\Local\Temp\4012222297.exe	C:\Users\admin\AppData\Local\Temp\4012222297.exe	—	wingpno.exe
User: admin Integrity Level: MEDIUM Exit code: 0
588	cmd.exe /C WScript "C:\ProgramData\nEzJvZquBf\r.vbs"	C:\Windows\system32\cmd.exe	—	1677810676.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
2300	WScript "C:\ProgramData\nEzJvZquBf\r.vbs"	C:\Windows\system32\wscript.exe		cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385
1392	"C:\Windows\system32\taskmgr.exe" /4	C:\Windows\system32\taskmgr.exe	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3104	"C:\Users\admin\AppData\Local\Temp\winjizm.exe"	C:\Users\admin\AppData\Local\Temp\winjizm.exe	—	explorer.exe
User: admin Integrity Level: MEDIUM Exit code: 0

Add for printing

Total events

602

Read events

524

Write events

Delete events

Modification events


(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:	write	Name:	DisableAntiSpyware
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:	write	Name:	DisableScanOnRealtimeEnable
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:	write	Name:	DisableOnAccessProtection
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:	write	Name:	DisableBehaviorMonitoring
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	AntiVirusOverride
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	UpdatesOverride
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	FirewallOverride
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	AntiVirusDisableNotify
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	UpdatesDisableNotify
Value: 1
(PID) Process:	(908) winjizm.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:	write	Name:	AutoUpdateDisableNotify
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3088	1677810676.exe	C:\ProgramData\nEzJvZquBf\windvcmgr.exe		—
		MD5:—	SHA256:—
3608	wingpno.exe	C:\Users\admin\AppData\Local\Temp\4012222297.exe		—
		MD5:EE5F38D898E0F203D5254FF4AFDB603D	SHA256:AA15D8286E696979B54A04B0498ED3CA9C5FFAD2FC8C4286D17D2F244E6ECCBA
908	winjizm.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\11[1].exe		executable
		MD5:F5ED113271906F41A7C36396F6747FFD	SHA256:1211E5CB3FC5D9A659831FBBD55331226347A7DE10C4406538CDFC8C969D49CE
3088	1677810676.exe	C:\ProgramData\nEzJvZquBf\cfgi		text
		MD5:C95A506C0669AB43CB0EF018F6703D52	SHA256:1A8D366A29921BF974237E35BB57B861B78E248E45FBF6DA04A06D0DAB7D51E8
3932	2173339871.exe	C:\Users\admin\3722997311379097\wingpno.exe		executable
		MD5:F5ED113271906F41A7C36396F6747FFD	SHA256:1211E5CB3FC5D9A659831FBBD55331226347A7DE10C4406538CDFC8C969D49CE
3088	1677810676.exe	C:\ProgramData\nEzJvZquBf\cfg		text
		MD5:01B03DD5C6B4E2757D82D6F775F18AA6	SHA256:9807DD9E6A0A374732502AE2950A1922D9E0FF3A52842CDA02B5B878733785B3
3088	1677810676.exe	C:\ProgramData\nEzJvZquBf\windvcmgr		—
		MD5:EE5F38D898E0F203D5254FF4AFDB603D	SHA256:AA15D8286E696979B54A04B0498ED3CA9C5FFAD2FC8C4286D17D2F244E6ECCBA
908	winjizm.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\22[1].exe		—
		MD5:EE5F38D898E0F203D5254FF4AFDB603D	SHA256:AA15D8286E696979B54A04B0498ED3CA9C5FFAD2FC8C4286D17D2F244E6ECCBA
908	winjizm.exe	C:\Users\admin\AppData\Local\Temp\2173339871.exe		executable
		MD5:F5ED113271906F41A7C36396F6747FFD	SHA256:1211E5CB3FC5D9A659831FBBD55331226347A7DE10C4406538CDFC8C969D49CE
2300	wscript.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTeEqNLdqe.url		text
		MD5:2D8B5417B1F66AE3A1F63884D9C487FF	SHA256:7CC41E8D2A8FF132F72CBFD0CC8A5BC904FE9EC217F95E61D31D63CE342ABF20

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
908	winjizm.exe	GET	—	92.63.197.59:80	http://92.63.197.59/11.exe	RU	—	—	malicious
908	winjizm.exe	GET	—	92.63.197.59:80	http://92.63.197.59/22.exe	RU	—	—	malicious
908	winjizm.exe	GET	200	92.63.197.59:80	http://92.63.197.59/11.exe	RU	executable	149 Kb	malicious
908	winjizm.exe	GET	200	92.63.197.59:80	http://92.63.197.59/22.exe	RU	—	1.91 Mb	malicious
3608	wingpno.exe	GET	304	92.63.197.59:80	http://92.63.197.59/22.exe	RU	—	—	malicious
908	winjizm.exe	GET	404	92.63.197.59:80	http://92.63.197.59/33.exe	RU	html	178 b	malicious
908	winjizm.exe	GET	404	92.63.197.59:80	http://92.63.197.59/44.exe	RU	html	178 b	malicious
3608	wingpno.exe	GET	404	92.63.197.59:80	http://92.63.197.59/55.exe	RU	html	178 b	malicious
908	winjizm.exe	GET	404	92.63.197.59:80	http://92.63.197.59/55.exe	RU	html	178 b	malicious
3608	wingpno.exe	GET	404	92.63.197.59:80	http://92.63.197.59/44.exe	RU	html	178 b	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3608	wingpno.exe	92.63.197.59:80	—	—	RU	malicious
3088	1677810676.exe	92.63.197.153:80	—	—	RU	malicious
2644	wuapp.exe	92.63.197.153:7575	—	—	RU	malicious
908	winjizm.exe	92.63.197.59:80	—	—	RU	malicious
3612	wuapp.exe	92.63.197.153:7575	—	—	RU	malicious
—	—	92.63.197.153:7575	—	—	RU	malicious
3888	wuapp.exe	92.63.197.153:7575	—	—	RU	malicious

DNS requests

Domain	IP	Reputation
gaieufhaefuefh.su	—	unknown
isohgohrusurgd.su	—	unknown
ahoouhrghsudmf.su	—	unknown
uhiueaaubgbuad.su	—	unknown
oaoeuoouegands.su	—	unknown
rutuneuenfuhus.su	—	unknown
aeaunengieisia.su	—	unknown
uririneinignin.su	—	unknown
ezeiafzbgzabzd.su	—	unknown
eunuegnuaebuan.su	—	unknown

Threats

PID	Process	Class	Message
908	winjizm.exe	A Network Trojan was detected	ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01
908	winjizm.exe	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
908	winjizm.exe	A Network Trojan was detected	ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01
908	winjizm.exe	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
908	winjizm.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
908	winjizm.exe	A Network Trojan was detected	ET TROJAN JS/Nemucod.M.gen downloading EXE payload
908	winjizm.exe	Potentially Bad Traffic	ET INFO SUSPICIOUS Dotted Quad Host MZ Response
908	winjizm.exe	Misc activity	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
908	winjizm.exe	A Network Trojan was detected	ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01
908	winjizm.exe	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host

10 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

winjizm.exe

C1F2B89C27C0092B0D410C39426A2781

1A2185250D8119A55033AD2148E0D211B9E48127

874D2BF4A81A29158653E24FAB1C52A5503D4939F13232EEAED50A160EF9D87E

6144:dl4r60uP40ePNkd2n8zJX2/D2GckUxo9:dqQNePGht2/D9ce

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

NEMUCOD was detected

Disables Windows System Restore

Disables Windows Defender Real-time monitoring

Changes Security Center notification settings

Downloads executable files from the Internet

Downloads executable files from IP

PHORPIEX was detected

Changes the autorun value in the registry

MINER was detected

Writes to a start menu file

Connects to CnC server

SUSPICIOUS

Executable content was dropped or overwritten

Creates files in the user directory

Starts itself from another location

Creates files in the program directory

Starts CMD.EXE for commands execution

Executes scripts

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Imports

Exports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings