joker | 0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe
Size

57KB
MD5

0d78c4a6febf4fec9088291e1e93836a
SHA1

32457a451a63a1d3d95332c82e11b711877bfafd
SHA256

0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6
SHA512

06912945293172bcee4d80c578e35c20eec0a918894d68e78811ade5a9f8db2d5830ff606328707fe5efc16fbaa5914c74593cdb783cb204a41be608faa71e35
SSDEEP

768:iewE87j9Htl4XseDJRgVacu35yglPZ+BLWS2v6d634vAevTb0gzsg5utVue:DWkXt1EtMQshv6d44IePDIVz

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
3388	inl355A.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
664	attrib.exe
1988	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	inl355A.tmp

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu428.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1635448799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu428.site	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985214"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1644668883"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1635448799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8C9A37F5-37F1-11ED-B696-5A10AEE59B4B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985214"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu428.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu428.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu428.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370339588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	reg.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe
Token: SeIncBasePriorityPrivilege	3388	inl355A.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4728	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4728	iexplore.exe
4728	iexplore.exe
3296	IEXPLORE.EXE
3296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2052	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	81
PID 4996 wrote to memory of 2052	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	81
PID 4996 wrote to memory of 2052	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	81
PID 2052 wrote to memory of 4212	2052	cmd.exe	83
PID 2052 wrote to memory of 4212	2052	cmd.exe	83
PID 2052 wrote to memory of 4212	2052	cmd.exe	83
PID 4212 wrote to memory of 4728	4212	cmd.exe	85
PID 4212 wrote to memory of 4728	4212	cmd.exe	85
PID 4212 wrote to memory of 1656	4212	cmd.exe	86
PID 4212 wrote to memory of 1656	4212	cmd.exe	86
PID 4212 wrote to memory of 1656	4212	cmd.exe	86
PID 4212 wrote to memory of 4164	4212	cmd.exe	87
PID 4212 wrote to memory of 4164	4212	cmd.exe	87
PID 4212 wrote to memory of 4164	4212	cmd.exe	87
PID 4164 wrote to memory of 2732	4164	cmd.exe	89
PID 4164 wrote to memory of 2732	4164	cmd.exe	89
PID 4164 wrote to memory of 2732	4164	cmd.exe	89
PID 4164 wrote to memory of 3484	4164	cmd.exe	90
PID 4164 wrote to memory of 3484	4164	cmd.exe	90
PID 4164 wrote to memory of 3484	4164	cmd.exe	90
PID 4996 wrote to memory of 3388	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	91
PID 4996 wrote to memory of 3388	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	91
PID 4996 wrote to memory of 3388	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	91
PID 4164 wrote to memory of 232	4164	cmd.exe	92
PID 4164 wrote to memory of 232	4164	cmd.exe	92
PID 4164 wrote to memory of 232	4164	cmd.exe	92
PID 4728 wrote to memory of 3296	4728	iexplore.exe	94
PID 4728 wrote to memory of 3296	4728	iexplore.exe	94
PID 4728 wrote to memory of 3296	4728	iexplore.exe	94
PID 4164 wrote to memory of 3964	4164	cmd.exe	93
PID 4164 wrote to memory of 3964	4164	cmd.exe	93
PID 4164 wrote to memory of 3964	4164	cmd.exe	93
PID 4996 wrote to memory of 2144	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	95
PID 4996 wrote to memory of 2144	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	95
PID 4996 wrote to memory of 2144	4996	0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe	95
PID 4164 wrote to memory of 1256	4164	cmd.exe	102
PID 4164 wrote to memory of 1256	4164	cmd.exe	102
PID 4164 wrote to memory of 1256	4164	cmd.exe	102
PID 4164 wrote to memory of 664	4164	cmd.exe	96
PID 4164 wrote to memory of 664	4164	cmd.exe	96
PID 4164 wrote to memory of 664	4164	cmd.exe	96
PID 4164 wrote to memory of 1988	4164	cmd.exe	97
PID 4164 wrote to memory of 1988	4164	cmd.exe	97
PID 4164 wrote to memory of 1988	4164	cmd.exe	97
PID 4164 wrote to memory of 2208	4164	cmd.exe	98
PID 4164 wrote to memory of 2208	4164	cmd.exe	98
PID 4164 wrote to memory of 2208	4164	cmd.exe	98
PID 4164 wrote to memory of 4892	4164	cmd.exe	99
PID 4164 wrote to memory of 4892	4164	cmd.exe	99
PID 4164 wrote to memory of 4892	4164	cmd.exe	99
PID 2208 wrote to memory of 3208	2208	rundll32.exe	101
PID 2208 wrote to memory of 3208	2208	rundll32.exe	101
PID 2208 wrote to memory of 3208	2208	rundll32.exe	101
PID 3208 wrote to memory of 3860	3208	runonce.exe	103
PID 3208 wrote to memory of 3860	3208	runonce.exe	103
PID 3208 wrote to memory of 3860	3208	runonce.exe	103
PID 3388 wrote to memory of 2272	3388	inl355A.tmp	113
PID 3388 wrote to memory of 2272	3388	inl355A.tmp	113
PID 3388 wrote to memory of 2272	3388	inl355A.tmp	113

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
664	attrib.exe
1988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe
"C:\Users\Admin\AppData\Local\Temp\0da04b28bae6ce3c0b62e1c3bda81fa001bf016cdc375eb234ad851cfb6af4b6.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cowon2011_check.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4728 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3296
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2732
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f
        5⤵
        
        PID:232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:3964
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:664
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1988
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2208
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:3860
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:4892
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:1256
- C:\Users\Admin\AppData\Local\Temp\inl355A.tmp
  C:\Users\Admin\AppData\Local\Temp\inl355A.tmp
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl355A.tmp > nul
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0DA04B~1.EXE > nul
  2⤵
  PID:2144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
1520b1f0e8660cc8553264ce46871efd

SHA1
70c43f2c0b7599f782461590f8e1650a2df5dbfe

SHA256
8bb8dd5446da57093db31c10b4093a2378a9324f137d3eaa21ab0027e191c09e

SHA512
6ad8d5f620738988286981654070c9a4e2542f629f4e5245381143a2a88c98922145759ff8d90546e1a617639a7dd335ddca4aba5435fb216c01c705bc4f0be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
25959b13d5dced1c2d5f82b7c4b3932b

SHA1
3150ee5a262e3d861e511f110ae82b37522d6dd8

SHA256
70ca01fb99e8e0993aa77a5b7c42705444236a597806aeb8096d9098551892b6

SHA512
f89b83e75e9c564dec976c938a98657499d5f67cc2bd1a7d27cf1e1e104b0957bdc434d768a27de6c0830113b922c2c35ef8f79b14eeb1fd8756a62e7957a802

Download Submit
C:\Users\Admin\AppData\Local\Temp\cowon2011_check.bat

Filesize
53B

MD5
23962a245f75fe25510051582203aff1

SHA1
20832a3a1179bb2730194d2f7738d41d5d669a43

SHA256
1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

SHA512
dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl355A.tmp

Filesize
57.2MB

MD5
eea99804fb4cf9c544636521e09d044d

SHA1
2e4f1f2b193b8c30f2f1586ebd844c5d61cc4458

SHA256
8e4ce5c89d85884c499102979f3492bfb6941cac94ee3903e02c736882570954

SHA512
3ae3055a746cb91c617a6853eb8cdb2ab570a95dde82f08459ca4b06137d6746a1464b201284f55cda468d05d1377ef41d624589506309a844725d430ee9efc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl355A.tmp

Filesize
57.2MB

MD5
eea99804fb4cf9c544636521e09d044d

SHA1
2e4f1f2b193b8c30f2f1586ebd844c5d61cc4458

SHA256
8e4ce5c89d85884c499102979f3492bfb6941cac94ee3903e02c736882570954

SHA512
3ae3055a746cb91c617a6853eb8cdb2ab570a95dde82f08459ca4b06137d6746a1464b201284f55cda468d05d1377ef41d624589506309a844725d430ee9efc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

Filesize
630B

MD5
def799e58a41b0cc7912581957c6b70b

SHA1
92b7b065250910aae63b782c8aa9548289b7d7d5

SHA256
d5c4b84330a5c67f8c86ee470c66ff8f52124f6dbcb29f939561c9013b5c6c20

SHA512
20be77f16b629d023a4456925ec3d093fd3f202f6b208dd42c878614248b78da52da0f5c004d06d7d4d1583291ce6901e9d8157eadf129b7032b2fb902eb1ce5

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.bat

Filesize
3KB

MD5
286fe459674aef6eee17f6ac79a15fdb

SHA1
233dc43099c575a67b05fc1076e676324fd6e63d

SHA256
872cc596dc1fe6d5a131129bd84c2a76d6874e9c57ab2cd792d4d12b6f014fd2

SHA512
c9acc4a134001da76e7ae6aa5ae65ce58501942dfc1f80959ae4db27c06010db753c9d115eedbe0b2b0e30dd5c4dcd1d32816493b053c65cee81d3a343c87314

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.inf

Filesize
492B

MD5
34c14b8530e1094e792527f7a474fe77

SHA1
f71c4e9091140256b34c18220d1dd1efab1f301d

SHA256
fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

SHA512
25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.bat

Filesize
3KB

MD5
d4917ae9072a10d8e12ef3b282b25b3b

SHA1
bd9ec6c6395997525ec7c15ecca2f115573cc14c

SHA256
6f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b

SHA512
c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.inf

Filesize
247B

MD5
ca436f6f187bc049f9271ecdcbf348fa

SHA1
bf8a548071cfc150f7affb802538edf03d281106

SHA256
6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

SHA512
d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\4.bat

Filesize
5.8MB

MD5
0c1a0607be94ad2ca1440bf8da446703

SHA1
fc4aa2127aac9935df43295ad687c3f4f2bcdc21

SHA256
24f05cfdca5d4dc2dec19867a599bd170cf172035c8cd94e6fac49910c567b39

SHA512
bd5b5d66a60650780f15bd9dcc6810c51e759bddf2fe7f9b138042fe3566773c44bab47d64e49b9fefa0c5d6bad53b395a590845a4d66df7d5c465df4b7d3b53

Download Submit
memory/4728-143-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-154-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-157-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-155-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-153-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-169-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-147-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-152-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-172-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-175-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-151-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-164-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-178-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-179-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-180-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-181-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-183-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-162-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-186-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-148-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-189-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-161-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-196-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-184-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-160-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-223-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-199-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-145-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-142-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-188-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-140-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-201-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-202-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-203-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-208-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-139-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-210-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-211-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-212-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-213-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-214-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-216-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-217-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4728-222-0x00007FFEA70B0000-0x00007FFEA711E000-memory.dmp

Filesize
440KB

Download
memory/4996-132-0x0000000000FC0000-0x0000000000FE6000-memory.dmp

Filesize
152KB

Download
memory/4996-185-0x0000000000FC0000-0x0000000000FE6000-memory.dmp

Filesize
152KB

Download
memory/4996-133-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads