Overview

overview

10

Static

static

bcfe72d733...24.exe

windows7-x64

10

bcfe72d733...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2022 22:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bcfe72d7338bea0db62e187619993434e66452a6424408784409ccfa8752c024.exe

  • Size

    3.4MB

  • MD5

    32718480a706f43d85f7478c07595b5e

  • SHA1

    e44b81fe3d61529bfa2ed2005d76bdcdb63c6526

  • SHA256

    bcfe72d7338bea0db62e187619993434e66452a6424408784409ccfa8752c024

  • SHA512

    5836767c9bd1b44fa68925e768c1578a7be4d69245fecdd2ce9bef08e73f7b1dae5d31eab5810c746cc8379f23540365db2a27a204d835647f659a7c7f4bb9a1

  • SSDEEP

    98304:2lG4t8z7N7Qsmvxc3bxGTYZDQxXjOYgfi0dO4O/EgrbKJwv8qr:pz7NElvxcbOxzMM5/jSS0qr

Score
10/10
jokeraspackv2infostealertrojan

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 9 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcfe72d7338bea0db62e187619993434e66452a6424408784409ccfa8752c024.exe
    "C:\Users\Admin\AppData\Local\Temp\bcfe72d7338bea0db62e187619993434e66452a6424408784409ccfa8752c024.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\调皮猴辅助.exe
      "C:\Users\Admin\AppData\Local\Temp\调皮猴辅助.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:892
    • C:\Users\Admin\AppData\Local\Temp\家庭用户.exe
      "C:\Users\Admin\AppData\Local\Temp\家庭用户.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\uninstal.bat
        3⤵
          PID:1040
      • C:\Users\Admin\AppData\Local\Temp\用户2.exe
        "C:\Users\Admin\AppData\Local\Temp\用户2.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\DELME.BAT
          3⤵
            PID:1764
        • C:\Users\Admin\AppData\Local\Temp\windowliua.exe
          "C:\Users\Admin\AppData\Local\Temp\windowliua.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Program Files\windowss.exe
            "C:\Program Files\windowss.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1084
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ping 127.0.0.1 -n 2 &del "C:\Users\Admin\AppData\Local\Temp\windowliua.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 2
              4⤵
              • Runs ping.exe
              PID:1572

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\windowss.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\windowliua.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\windowliua.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\家庭用户.exe
        Filesize

        732KB

        MD5

        8183b24c5b05fb5a3afe114945c5c168

        SHA1

        2233b8013e7c16bf29501a40fe020d5bc3e8d16d

        SHA256

        f908e097cfc4dd96d4771a360d2f6f8b1e773d9920f6b777cf70754b96aeedde

        SHA512

        57310da434094e65d46aa1448bc76e7d13e495bfb7f8619150d91cbe8053a77c510250af5f73db73dd46b976693ff9b21fab1fb7d57d9932ca5197f410a6f3ca

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\家庭用户.exe
        Filesize

        732KB

        MD5

        8183b24c5b05fb5a3afe114945c5c168

        SHA1

        2233b8013e7c16bf29501a40fe020d5bc3e8d16d

        SHA256

        f908e097cfc4dd96d4771a360d2f6f8b1e773d9920f6b777cf70754b96aeedde

        SHA512

        57310da434094e65d46aa1448bc76e7d13e495bfb7f8619150d91cbe8053a77c510250af5f73db73dd46b976693ff9b21fab1fb7d57d9932ca5197f410a6f3ca

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\用户2.exe
        Filesize

        765KB

        MD5

        37e00e589768a8ac072eb2bbfacdba99

        SHA1

        99e51a2fffb17779c8cfe7d1ec615b7647a0ed19

        SHA256

        7450aa85a6bec52cd2c5b0d03bdec061a6d325b9d6c5ae2335f7ab02c8716aa7

        SHA512

        d128012da86de62f298b98e19fc7794e54d7e318bd30fb04e9633cc4ee364ca962b089175be6a5bb1521c67598ad4ef8252f6dd124e7ba207fa05dedfa88d0f6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\用户2.exe
        Filesize

        765KB

        MD5

        37e00e589768a8ac072eb2bbfacdba99

        SHA1

        99e51a2fffb17779c8cfe7d1ec615b7647a0ed19

        SHA256

        7450aa85a6bec52cd2c5b0d03bdec061a6d325b9d6c5ae2335f7ab02c8716aa7

        SHA512

        d128012da86de62f298b98e19fc7794e54d7e318bd30fb04e9633cc4ee364ca962b089175be6a5bb1521c67598ad4ef8252f6dd124e7ba207fa05dedfa88d0f6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\调皮猴辅助.exe
        Filesize

        2.2MB

        MD5

        b31eda9a0a9502ff3e9f991a9b46855c

        SHA1

        6e495665d4357686e5a4a6883bcfb2fe28b3996f

        SHA256

        eb4150a63bd6073c025831cbe227e23812b19dd2fa95c842c631c2e156c89451

        SHA512

        f1e606c4df5f7eea0b1900eba9bd381bc5858a7ad2c8fc65a7a02e918112f1b6c21583af80a8371acdbd6b0edae3aa15091f816e5b926bce992b39b96cfd9a97

        Download Submit

      • C:\Windows\DELME.BAT
        Filesize

        132B

        MD5

        b7909254b7b60f4d489bdcf5afa2a0af

        SHA1

        c31f467208a3a2ff4605a3d043113db84f11a12c

        SHA256

        56e6e3bebc951674489ab23763d8e864b6d18ca03639ec8ee224abc5f3457026

        SHA512

        9a378bf7471e66b9bf108a25cb1da8aba65f10a166be91dee130d3bd0f4852295dbbca263d35eda7da71a20f0e8b20e3f4c30f35b28ab0437dfffac789e74079

        Download Submit

      • C:\Windows\uninstal.bat
        Filesize

        134B

        MD5

        6fda656ff825b917490d093a3edb1a7e

        SHA1

        ae08f0fb691cf4728111e9a1c77beb914a8477ac

        SHA256

        2634972971c137fc744d8ef3caec98a8853f9866e0e7ad6c203549918b6bb2dc

        SHA512

        4b4800abf18fe805808d1efedcb8a6813df046928b9aa3cac3b155942b2627e50071f35d1ab65ddc7f8fffda94f7e35adccd7ea701fcb0c9a6dd4a151b2a460d

        Download Submit

      • \Program Files\windowss.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • \Program Files\windowss.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • \Users\Admin\AppData\Local\Temp\windowliua.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • \Users\Admin\AppData\Local\Temp\windowliua.exe
        Filesize

        844KB

        MD5

        fc9a93ad351be6c16602705f63330cae

        SHA1

        9c81b00f991ad0640ebdc31ff85a47998a898c39

        SHA256

        c54b6a648e5b182ccb3899bb915262d232383dd60156dcfc65b572065e918059

        SHA512

        41f468bc563de4a78e2d015116a969a3d7f4caa2f0e6b3c0fd26e2fc7a958b378544c5d14b2a9096690b961b5d89fab07ba1840ef3c19147c3d3f220af8473d5

        Download Submit

      • \Users\Admin\AppData\Local\Temp\家庭用户.exe
        Filesize

        732KB

        MD5

        8183b24c5b05fb5a3afe114945c5c168

        SHA1

        2233b8013e7c16bf29501a40fe020d5bc3e8d16d

        SHA256

        f908e097cfc4dd96d4771a360d2f6f8b1e773d9920f6b777cf70754b96aeedde

        SHA512

        57310da434094e65d46aa1448bc76e7d13e495bfb7f8619150d91cbe8053a77c510250af5f73db73dd46b976693ff9b21fab1fb7d57d9932ca5197f410a6f3ca

        Download Submit

      • \Users\Admin\AppData\Local\Temp\家庭用户.exe
        Filesize

        732KB

        MD5

        8183b24c5b05fb5a3afe114945c5c168

        SHA1

        2233b8013e7c16bf29501a40fe020d5bc3e8d16d

        SHA256

        f908e097cfc4dd96d4771a360d2f6f8b1e773d9920f6b777cf70754b96aeedde

        SHA512

        57310da434094e65d46aa1448bc76e7d13e495bfb7f8619150d91cbe8053a77c510250af5f73db73dd46b976693ff9b21fab1fb7d57d9932ca5197f410a6f3ca

        Download Submit

      • \Users\Admin\AppData\Local\Temp\用户2.exe
        Filesize

        765KB

        MD5

        37e00e589768a8ac072eb2bbfacdba99

        SHA1

        99e51a2fffb17779c8cfe7d1ec615b7647a0ed19

        SHA256

        7450aa85a6bec52cd2c5b0d03bdec061a6d325b9d6c5ae2335f7ab02c8716aa7

        SHA512

        d128012da86de62f298b98e19fc7794e54d7e318bd30fb04e9633cc4ee364ca962b089175be6a5bb1521c67598ad4ef8252f6dd124e7ba207fa05dedfa88d0f6

        Download Submit

      • \Users\Admin\AppData\Local\Temp\用户2.exe
        Filesize

        765KB

        MD5

        37e00e589768a8ac072eb2bbfacdba99

        SHA1

        99e51a2fffb17779c8cfe7d1ec615b7647a0ed19

        SHA256

        7450aa85a6bec52cd2c5b0d03bdec061a6d325b9d6c5ae2335f7ab02c8716aa7

        SHA512

        d128012da86de62f298b98e19fc7794e54d7e318bd30fb04e9633cc4ee364ca962b089175be6a5bb1521c67598ad4ef8252f6dd124e7ba207fa05dedfa88d0f6

        Download Submit

      • \Users\Admin\AppData\Local\Temp\调皮猴辅助.exe
        Filesize

        2.2MB

        MD5

        b31eda9a0a9502ff3e9f991a9b46855c

        SHA1

        6e495665d4357686e5a4a6883bcfb2fe28b3996f

        SHA256

        eb4150a63bd6073c025831cbe227e23812b19dd2fa95c842c631c2e156c89451

        SHA512

        f1e606c4df5f7eea0b1900eba9bd381bc5858a7ad2c8fc65a7a02e918112f1b6c21583af80a8371acdbd6b0edae3aa15091f816e5b926bce992b39b96cfd9a97

        Download Submit

      • memory/892-102-0x0000000000400000-0x0000000000715000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/892-63-0x0000000000400000-0x0000000000715000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/892-67-0x0000000000400000-0x0000000000715000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/892-64-0x0000000000400000-0x0000000000715000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/892-73-0x0000000000400000-0x0000000000715000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1696-71-0x0000000002E90000-0x00000000031A5000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/1696-55-0x0000000000220000-0x00000000002CC000-memory.dmp

        Filesize

        688KB

        Download