joker | 41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe
Size

57KB
MD5

619444aaaccb2409893d167eb6fdce91
SHA1

26431fa33a258eea1f5aca88f57a9c5874e18b4a
SHA256

41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4
SHA512

9feef92dd0c85739e9b54de18190e6847d5219337ec967df139837100a72de97fb8e24b6e01dfab98f4c2725fe267dc0a9ab7c04c149140beb656f116e2a7c0d
SSDEEP

1536:6qF+qJB0ODqnmmmcLLWBPkUZ9vAbOu/Ys5MpmMe4O:RF5J2OGnmmJLtogOu+mMLO

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
1992	inlA0A6.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
324	attrib.exe
1928	attrib.exe

Deletes itself 1 IoCs

pid	Process
2284	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe
1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu424.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu424.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu424.site\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D70C141-37E1-11ED-B559-F63187E7FFAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu424.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu424.site\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.71628.com/?i"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1708	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeRestorePrivilege	1592	rundll32.exe
Token: SeIncBasePriorityPrivilege	1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1176	iexplore.exe
1176	iexplore.exe
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 764	1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe	30
PID 1900 wrote to memory of 764	1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe	30
PID 1900 wrote to memory of 764	1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe	30
PID 1900 wrote to memory of 764	1900	41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe	30
PID 764 wrote to memory of 1516	764	cmd.exe	32
PID 764 wrote to memory of 1516	764	cmd.exe	32
PID 764 wrote to memory of 1516	764	cmd.exe	32
PID 764 wrote to memory of 1516	764	cmd.exe	32
PID 1516 wrote to memory of 1176	1516	cmd.exe	34
PID 1516 wrote to memory of 1176	1516	cmd.exe	34
PID 1516 wrote to memory of 1176	1516	cmd.exe	34
PID 1516 wrote to memory of 1176	1516	cmd.exe	34
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1708	1516	cmd.exe	35
PID 1516 wrote to memory of 1324	1516	cmd.exe	36
PID 1516 wrote to memory of 1324	1516	cmd.exe	36
PID 1516 wrote to memory of 1324	1516	cmd.exe	36
PID 1516 wrote to memory of 1324	1516	cmd.exe	36
PID 1324 wrote to memory of 1528	1324	cmd.exe	38
PID 1324 wrote to memory of 1528	1324	cmd.exe	38
PID 1324 wrote to memory of 1528	1324	cmd.exe	38
PID 1324 wrote to memory of 1528	1324	cmd.exe	38
PID 1176 wrote to memory of 1172	1176	iexplore.exe	39
PID 1176 wrote to memory of 1172	1176	iexplore.exe	39
PID 1176 wrote to memory of 1172	1176	iexplore.exe	39
PID 1176 wrote to memory of 1172	1176	iexplore.exe	39
PID 1324 wrote to memory of 1508	1324	cmd.exe	40
PID 1324 wrote to memory of 1508	1324	cmd.exe	40
PID 1324 wrote to memory of 1508	1324	cmd.exe	40
PID 1324 wrote to memory of 1508	1324	cmd.exe	40
PID 1324 wrote to memory of 1656	1324	cmd.exe	41
PID 1324 wrote to memory of 1656	1324	cmd.exe	41
PID 1324 wrote to memory of 1656	1324	cmd.exe	41
PID 1324 wrote to memory of 1656	1324	cmd.exe	41
PID 1324 wrote to memory of 960	1324	cmd.exe	42
PID 1324 wrote to memory of 960	1324	cmd.exe	42
PID 1324 wrote to memory of 960	1324	cmd.exe	42
PID 1324 wrote to memory of 960	1324	cmd.exe	42
PID 1324 wrote to memory of 1892	1324	cmd.exe	43
PID 1324 wrote to memory of 1892	1324	cmd.exe	43
PID 1324 wrote to memory of 1892	1324	cmd.exe	43
PID 1324 wrote to memory of 1892	1324	cmd.exe	43
PID 1324 wrote to memory of 324	1324	cmd.exe	44
PID 1324 wrote to memory of 324	1324	cmd.exe	44
PID 1324 wrote to memory of 324	1324	cmd.exe	44
PID 1324 wrote to memory of 324	1324	cmd.exe	44
PID 1324 wrote to memory of 1928	1324	cmd.exe	45
PID 1324 wrote to memory of 1928	1324	cmd.exe	45
PID 1324 wrote to memory of 1928	1324	cmd.exe	45
PID 1324 wrote to memory of 1928	1324	cmd.exe	45
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1592	1324	cmd.exe	46
PID 1324 wrote to memory of 1704	1324	cmd.exe	47
PID 1324 wrote to memory of 1704	1324	cmd.exe	47

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
324	attrib.exe
1928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe
"C:\Users\Admin\AppData\Local\Temp\41b8d73634f16f56e3684388a9c1e39b090340774eb3c9cebe3302d317d219c4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\kage2011_check.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1172
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f
        5⤵
        
        PID:1656
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:960
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:1892
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:324
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1928
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        
        PID:296
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:684
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:1704
- C:\Users\Admin\AppData\Local\Temp\inlA0A6.tmp
  C:\Users\Admin\AppData\Local\Temp\inlA0A6.tmp
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\41B8D7~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inlA0A6.tmp

Filesize
64.7MB

MD5
5a0df4a25dec84c281e5e8c1a054171b

SHA1
600de91564a8b5a407b983f6c9eb47e7fcc01f17

SHA256
d37e780e53a48a1c2f3425b830cedd85b259234b3556b4bdc282893a86626c89

SHA512
1a4e85fb0c414eab67517f0a001c8e0d3ae81c72e2a86492f0eb948b8287761184a6c96d3e4ccf787b6823a0f25567378ff1f86e8329e1c1152405136e7d2a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\kage2011_check.bat

Filesize
53B

MD5
23962a245f75fe25510051582203aff1

SHA1
20832a3a1179bb2730194d2f7738d41d5d669a43

SHA256
1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

SHA512
dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

Filesize
557B

MD5
60c54480fe85d58d72662fa3b1255f8f

SHA1
7e975bcf566b39ecffbf784231187ee8a753af88

SHA256
c87185e8b06aceab6578bdadd26d32251353c882f126643567bc7619e8b02c76

SHA512
299d36847b969c184151c83b59b88ac2322c2ee9d89643ae53994c2ae32299f45c8ace083e0c0cfbc4eb3136d16d57f126d4340b833140325deb4c980b93cf9a

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.bat

Filesize
3KB

MD5
286fe459674aef6eee17f6ac79a15fdb

SHA1
233dc43099c575a67b05fc1076e676324fd6e63d

SHA256
872cc596dc1fe6d5a131129bd84c2a76d6874e9c57ab2cd792d4d12b6f014fd2

SHA512
c9acc4a134001da76e7ae6aa5ae65ce58501942dfc1f80959ae4db27c06010db753c9d115eedbe0b2b0e30dd5c4dcd1d32816493b053c65cee81d3a343c87314

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.inf

Filesize
492B

MD5
34c14b8530e1094e792527f7a474fe77

SHA1
f71c4e9091140256b34c18220d1dd1efab1f301d

SHA256
fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

SHA512
25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.bat

Filesize
3KB

MD5
d4917ae9072a10d8e12ef3b282b25b3b

SHA1
bd9ec6c6395997525ec7c15ecca2f115573cc14c

SHA256
6f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b

SHA512
c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.inf

Filesize
247B

MD5
ca436f6f187bc049f9271ecdcbf348fa

SHA1
bf8a548071cfc150f7affb802538edf03d281106

SHA256
6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

SHA512
d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\4.bat

Filesize
12.3MB

MD5
53f92648225c8608a14a8cfb46cbb76d

SHA1
5ff3195292b298f6542525d8eb2ac949f2e17708

SHA256
033463e38dae2ddaf36dbe067ffc1bc488ddf712200c1278d9bf28506a85abb8

SHA512
637f8683ee7800f45a4ea1767d3cb8ed1c6fd89ca25d6e6ae4fc220fc5a3588d81721b749bdf4ee49c2e5d7790043eada3c8d053bb704c9f94042ca3cec332c0

Download Submit
\Users\Admin\AppData\Local\Temp\inlA0A6.tmp

Filesize
64.8MB

MD5
f222e8de4c5a2d0f9a7b7226284a2173

SHA1
a73fe1f82855f7f1bd78adfbb8b0fcd29c93fe3d

SHA256
0ae67cef77463383679bcb26641b73d86648db5aff703c7674bae109fc08f531

SHA512
4ad553fdfb737fa965508110e96821a877f096742eb22ce3c7fe89112ebf991307b39f23df6256c8df45d52d29ebdb4e3d5dc6d8135c5a49f2abccfb514c65fb

Download Submit
\Users\Admin\AppData\Local\Temp\inlA0A6.tmp

Filesize
68.4MB

MD5
a457b7f9357949ed933f2c34ac95c6bc

SHA1
46f56479bad9ee39409e81e9ece83881630cd8c8

SHA256
98da80466be9d492ad69b08b9e971e2b8fdfd4d3a0a3bd637ecf2c182cf794b4

SHA512
857b46b2456c2bdf06f1d74ebc96c3799c3da7e7eee81f8b13018a853b9bfb6b8eeec5376dfc21a5e54b74ac422bcc6ed5fd15431ef0c416e9fcb970d77da553

Download Submit
memory/1176-62-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1176-66-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/1900-73-0x0000000000730000-0x000000000073F000-memory.dmp

Filesize
60KB

Download
memory/1900-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1900-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1900-55-0x00000000008B0000-0x00000000008D6000-memory.dmp

Filesize
152KB

Download
memory/1900-94-0x00000000008B0000-0x00000000008D6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads