joker | a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe
Size

54KB
MD5

a995678fc6a7b765fe5e8d5cdf8bb424
SHA1

07e1f77ecbf8334305375feffcdc34a3f79c9ff8
SHA256

a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39
SHA512

cecc70c717c2bc3e5f5fbcbc4f8316d86b10b95c26c0662ccadc6551c4f30340752a6b0b7004330bcc4424995dc9b99eaa70fa7a1a6997fcf8bbe17e67b035a2
SSDEEP

768:7HLiSTFE124rYp175AydSeq/ZWHGWlyw3TmiQKx4puSI3LVC9dBMYaeXmg+:zLiSTK29pwydSeqEHGWnxII3ZWGeXmg+

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
1468	inlB2B8.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4944	attrib.exe
756	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	inlB2B8.tmp

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\redload\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40918bbacecbd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2881275796"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207897bacecbd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu427.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985166"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu427.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2891901123"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu427.site\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985166"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu427.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2881275796"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000910415287ebff0a3eae82ba12ab2fde025b5c57d3a019d400b9478d63d9e5673000000000e800000000200002000000025afd3d859c1c61a82bf25c03c52ef4c4bff36f036d34488a78930e647add69020000000f398371f90066c2511856228eca1de3a8a9205235f27ae71ff543ebdba6aebad400000008738b8eb43426ec032642eb6ab72e1bbd075224c5ccc07f4a0bc9620af80f5756811b92609dbb0b987088f8b198880872e5e0eed2feb4be0d07c1c9b17a2e119	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D6ECB592-37C1-11ED-B696-7ED4F7B3352B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985166"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu427.site	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu427.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000000a92d415401ee56671b9dd8ea037b4862c6aa662ef6cddaf1d56b664cb1f9266000000000e8000000002000020000000c570086c0189c6cbf466816b5fbe0a203e3abec3444bfc34db7a00fc3dd1410020000000529d1fe1074595af4c20d9b860c53bdec6baab9d65820efd4e56c3c24767f91a4000000068a08a7afc5b9661b79bd4b024df5c15882c5971db145d366ef82d552c5223a5e93fbd58719c1759883219b4adf45f56814666818ddacbfbd17443d0afb92016	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\redload\\3.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe
Token: SeIncBasePriorityPrivilege	1468	inlB2B8.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3760	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3760	iexplore.exe
3760	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2320	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	87
PID 4988 wrote to memory of 2320	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	87
PID 4988 wrote to memory of 2320	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	87
PID 2320 wrote to memory of 32	2320	cmd.exe	89
PID 2320 wrote to memory of 32	2320	cmd.exe	89
PID 2320 wrote to memory of 32	2320	cmd.exe	89
PID 32 wrote to memory of 3760	32	cmd.exe	91
PID 32 wrote to memory of 3760	32	cmd.exe	91
PID 32 wrote to memory of 3584	32	cmd.exe	92
PID 32 wrote to memory of 3584	32	cmd.exe	92
PID 32 wrote to memory of 3584	32	cmd.exe	92
PID 32 wrote to memory of 3892	32	cmd.exe	93
PID 32 wrote to memory of 3892	32	cmd.exe	93
PID 32 wrote to memory of 3892	32	cmd.exe	93
PID 3892 wrote to memory of 4128	3892	cmd.exe	95
PID 3892 wrote to memory of 4128	3892	cmd.exe	95
PID 3892 wrote to memory of 4128	3892	cmd.exe	95
PID 3892 wrote to memory of 5092	3892	cmd.exe	97
PID 3892 wrote to memory of 5092	3892	cmd.exe	97
PID 3892 wrote to memory of 5092	3892	cmd.exe	97
PID 3892 wrote to memory of 4884	3892	cmd.exe	96
PID 3892 wrote to memory of 4884	3892	cmd.exe	96
PID 3892 wrote to memory of 4884	3892	cmd.exe	96
PID 3892 wrote to memory of 1892	3892	cmd.exe	98
PID 3892 wrote to memory of 1892	3892	cmd.exe	98
PID 3892 wrote to memory of 1892	3892	cmd.exe	98
PID 3892 wrote to memory of 4272	3892	cmd.exe	99
PID 3892 wrote to memory of 4272	3892	cmd.exe	99
PID 3892 wrote to memory of 4272	3892	cmd.exe	99
PID 3892 wrote to memory of 4944	3892	cmd.exe	102
PID 3892 wrote to memory of 4944	3892	cmd.exe	102
PID 3892 wrote to memory of 4944	3892	cmd.exe	102
PID 4988 wrote to memory of 1468	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	100
PID 4988 wrote to memory of 1468	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	100
PID 4988 wrote to memory of 1468	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	100
PID 3760 wrote to memory of 3036	3760	iexplore.exe	101
PID 3760 wrote to memory of 3036	3760	iexplore.exe	101
PID 3760 wrote to memory of 3036	3760	iexplore.exe	101
PID 4988 wrote to memory of 824	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	103
PID 4988 wrote to memory of 824	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	103
PID 4988 wrote to memory of 824	4988	a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe	103
PID 3892 wrote to memory of 756	3892	cmd.exe	104
PID 3892 wrote to memory of 756	3892	cmd.exe	104
PID 3892 wrote to memory of 756	3892	cmd.exe	104
PID 3892 wrote to memory of 3532	3892	cmd.exe	105
PID 3892 wrote to memory of 3532	3892	cmd.exe	105
PID 3892 wrote to memory of 3532	3892	cmd.exe	105
PID 3892 wrote to memory of 1680	3892	cmd.exe	107
PID 3892 wrote to memory of 1680	3892	cmd.exe	107
PID 3892 wrote to memory of 1680	3892	cmd.exe	107
PID 3532 wrote to memory of 4468	3532	rundll32.exe	108
PID 3532 wrote to memory of 4468	3532	rundll32.exe	108
PID 3532 wrote to memory of 4468	3532	rundll32.exe	108
PID 4468 wrote to memory of 2532	4468	runonce.exe	109
PID 4468 wrote to memory of 2532	4468	runonce.exe	109
PID 4468 wrote to memory of 2532	4468	runonce.exe	109
PID 1468 wrote to memory of 4936	1468	inlB2B8.tmp	114
PID 1468 wrote to memory of 4936	1468	inlB2B8.tmp	114
PID 1468 wrote to memory of 4936	1468	inlB2B8.tmp	114

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4944	attrib.exe
756	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe
"C:\Users\Admin\AppData\Local\Temp\a696e5fd34a8b4f248b02ad726dccfba1ab5e02acd533dad241b0e17112bbd39.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:32
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3760 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3036
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
      4⤵
      PID:3584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?S"" /f
        5⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:5092
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:1892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:4272
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4944
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:756
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3532
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:1680
- C:\Users\Admin\AppData\Local\Temp\inlB2B8.tmp
  C:\Users\Admin\AppData\Local\Temp\inlB2B8.tmp
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlB2B8.tmp > nul
    3⤵
    PID:4936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A696E5~1.EXE > nul
  2⤵
  PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C

Filesize
631B

MD5
5a813454bd2cb5e3321c9e5fecb5056c

SHA1
02937703479e284dd6638fbadfa33cc45ac34c28

SHA256
100e233f4d4e190240ff52081ca861c222505cf10367ff633494061f7763f4ec

SHA512
98ab39f780f2670401926087211ddf66f120a3cb142cfdaa454f3c14c32a0c66cfeac91cc7333be93b0513796b67f9cbd63316b65bc31d5acca099ae45d1e7e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C

Filesize
240B

MD5
636b41069b863650af7754ca857c3f29

SHA1
ba064aeea137e96100e6edc6ce62ddc95a5d1f03

SHA256
a0138536c85e68b131e8996b586db25d78d34353f85274e6d45539b80488b264

SHA512
c9ac91b952eded4cf7b6b7c333b98ac7caf29bcd785dcdbbb452f6a8801f0a245d5f918f33f9c7cd4c4e7daac08637618ce4bc52dc45769a3845d11fab04ba16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat

Filesize
1KB

MD5
02ce26dbc6b7f2000f17755ca75cfe4d

SHA1
f058d22e187e7fa32fdd6ceb0a75e389db4a6dfe

SHA256
2ce4c1ca43bd240c9cf7c3c1e692aa540ceb2ee0cd9c0a621d5de1fe4f47902b

SHA512
99d7e9a15782a32aa5d5a6a0070176a66afb157f9339ec69d01b5597a59bd84ee3588e01b6bb2e6b9709e96bc552c3a1735e49d2fe96dcd534756cf1be317816

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
790B

MD5
b18422bf438bbb7798280375a7bc0976

SHA1
c1b77b35e3a38ff2ad119f25e548beb5ff68c2e2

SHA256
ee8709e751067193dccdfe218108bdae6a30919d7b6c860bc848c7cc4b242fa4

SHA512
23cb9c74905f514a2bf4ef91afc53ceb08230b3ce68e3eab17bb36c674260d143a7e7105958ff4ed5c2a416bddffb3c7e28dcf8060cbf323c7e4cab71f613176

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlB2B8.tmp

Filesize
57.2MB

MD5
c7880b59de9107715adb9d063b22bc3e

SHA1
f004e337f103401e778ef4523c11342006a0e4e0

SHA256
7ec55f92d1da30cfd342fc9845f3879f2983447cc2d7228c022f85b258037427

SHA512
d38ba04524362fa1e23d991848ff548223bf0ed0ecef27d316dcf15c177f035522701165ce91e672d5783889837ae1ddcd4c4431a07f45bd64301e33eaf833cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlB2B8.tmp

Filesize
57.2MB

MD5
c7880b59de9107715adb9d063b22bc3e

SHA1
f004e337f103401e778ef4523c11342006a0e4e0

SHA256
7ec55f92d1da30cfd342fc9845f3879f2983447cc2d7228c022f85b258037427

SHA512
d38ba04524362fa1e23d991848ff548223bf0ed0ecef27d316dcf15c177f035522701165ce91e672d5783889837ae1ddcd4c4431a07f45bd64301e33eaf833cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat

Filesize
54B

MD5
504490369970f1c0eb580afbcdf91618

SHA1
b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

SHA256
a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

SHA512
5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.bat

Filesize
3KB

MD5
b13d4a59d37d8c293276a4c428ad5659

SHA1
710bfa65cfd533b78c564e15e0bbe954e9265ecf

SHA256
3aea9dee221648916706758561e23796b2325e4019b28a3070fe2fd8d1d4ed28

SHA512
8cb3aec7463cf7d14f333bb9257f03c7f7491f4da4fea3311e505f99b9f6797f0aa3f689355a6625d9f104b8511f7e75218b4c2fdd7f9ac96927d7aa4a6ed0ba

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.bat

Filesize
3KB

MD5
185a49cc37f1724dc196f67c42a76340

SHA1
27fde7b9ba462fc36ba5705832ae44b454d718cf

SHA256
3fe8fbf78cb9855c0cc663dda80354318fb2c7ef1dc4d378c98bb1383015140d

SHA512
97ee31a378404bae99616a057ddbed8450f56bfd5d0508b4cc3b864e73aa5d8d1f15b21c82ed3570494603ac90bb7cee1b8cbdae9d935bb1ddb71264004e4c22

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.inf

Filesize
248B

MD5
2197ffb407fb3b2250045c084f73b70a

SHA1
3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

SHA256
a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

SHA512
b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

Download Submit
C:\Users\Admin\AppData\Roaming\redload\4.bat

Filesize
5.8MB

MD5
50369bf2422ae348cda5089b345f652e

SHA1
73dfb1084921f487a08e5a6333ef9b56d72f2841

SHA256
436903395303bd91e94976f1a3f8292c14803fc0d60f4cf2937c57b5580cf543

SHA512
880b6b4c8f011d314c2c9e3f5053c4a480984eab62ca3d533e8903364ceea8f5326174c5044fd9796c2c5c4ef9dac645421119950a07ed26113b8ef19719df84

Download Submit
memory/3760-185-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-209-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-159-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-160-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-224-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-162-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-223-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-164-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-165-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-166-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-148-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-157-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-169-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-218-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-172-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-217-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-147-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-145-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-141-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-154-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-143-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-176-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-182-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-183-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-184-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-151-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-186-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-187-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-211-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-212-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-181-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-192-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-197-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-150-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-215-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-214-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-202-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-198-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-203-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-188-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-204-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-153-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-156-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/3760-213-0x00007FFEEF3F0000-0x00007FFEEF45E000-memory.dmp

Filesize
440KB

Download
memory/4988-133-0x00000000007D0000-0x00000000007D3000-memory.dmp

Filesize
12KB

Download
memory/4988-191-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/4988-134-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/4988-132-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads