Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8beead19f1...0b.exe

windows7-x64

10

8beead19f1...0b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2022, 16:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8beead19f19ceaa357d46eb78b65ad0b.exe

  • Size

    132KB

  • MD5

    8beead19f19ceaa357d46eb78b65ad0b

  • SHA1

    18dcea4f9e302d4e430b093d2cb516cb765f577d

  • SHA256

    5c4655b513f7c645a3549966aef30f94ec6ce60ea66f8047920a71a09eb3fab3

  • SHA512

    b498e621119f832aa7326731b803c7dabdac5e8b7f40c5ccc06042d87246e4c71399f6c64a8068fdd267b76d8e6a9c1d7d4ba024a2cf251b5510a24254e9d0b8

  • SSDEEP

    3072:81i/NU8bOMYcYYcmy5K/40g3nan3vx9kGSYng76s5YmMOMYcYY51i/NU87:qi/NjO5u//g+UGSYnum3Oai/Nj

Score
10/10
jokerinfostealerpersistencetrojan

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 59 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Views/modifies file attributes 1 TTPs 7 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8beead19f19ceaa357d46eb78b65ad0b.exe
    "C:\Users\Admin\AppData\Local\Temp\8beead19f19ceaa357d46eb78b65ad0b.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /im KSafeTray.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4528
    • C:\WINDOWS\sys.exe
      "C:\WINDOWS\sys.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Checks computer location settings
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /im KSafeTray.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4944 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1336
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
          4⤵
          • Views/modifies file attributes
          PID:1532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
          4⤵
          • Views/modifies file attributes
          PID:3092
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
          4⤵
          • Views/modifies file attributes
          PID:2796
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
          4⤵
          • Views/modifies file attributes
          PID:3372
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
          4⤵
          • Views/modifies file attributes
          PID:3944
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "C:\WINDOWS\sys.exe"
          4⤵
          • Drops file in Windows directory
          • Views/modifies file attributes
          PID:3040
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h "c:\sys.exe"
          4⤵
          • Views/modifies file attributes
          PID:1464
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del 8beead19f19ceaa357d46eb78b65ad0b.exe
      2⤵
        PID:4744

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      50ccb6305f667bc427d115125f962cac

      SHA1

      b0d82ebe2f5cf5b520ba7edcf7b2734cf4f2d200

      SHA256

      fd9644d82e1e00505eb4e716136b42befb20145a05057f0cb052d1793a853a58

      SHA512

      9687b5fefe3505705846b3dfa22cbcbcf7c04fdfc1f386998f1a0c8e275ad67faa9976ed51638cfe0d219422fd93dc8ee037653b96bf1956b298b31eb35b507c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      404B

      MD5

      691d89f6d0f05efa5d7c03bd99c1ef20

      SHA1

      dd17ea5c06b858dd114c04da17861789867f256a

      SHA256

      b2cdda53f9e386d27748bee12096120902a8bea6e783c8f003865252e7b24af7

      SHA512

      141cf20292ff82d308927b049607029f723d60e54c649311c87f124e1982c43c3697c0cad2d116ec5078b9ee464ea12e73d49d90f96a50dbca9c7b58662ce666

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat
      Filesize

      1KB

      MD5

      8897a0430252955fbece867beb0091bc

      SHA1

      967f0d5e8bafbc1575fca80d134242e485cbbd87

      SHA256

      85c8e3e39bd8cf64182e035081151e76682b7528eb394f590cff1bc2a5846a93

      SHA512

      9478759f3138f97fd733dec9eb457df3b5ff54c5c3df2e2e6853eec38ed7605f244a45c6cda8485a443838d8b5c5282627bd4ac0ed57f9977f2fe18de38093fa

      Download Submit

    • C:\WINDOWS\sys.exe
      Filesize

      132KB

      MD5

      42df30be9602b51954e41cc2d91b577e

      SHA1

      89217bb67dbab064b958f86c8e65be95cac47fdd

      SHA256

      6b1320117d8bef68a7695d98c797c5acf66c517d0a3873c24234118ffaa021c4

      SHA512

      be5aa5af95ba26ba41d1ace845a6cdeed79d91d71a6ae68881f2de6201c73aa6d643875ecd4ededf9135f6ad9363ad03c84df90c7c24ffa3f6967f2abb2948d8

      Download Submit

    • C:\Windows\sys.exe
      Filesize

      132KB

      MD5

      42df30be9602b51954e41cc2d91b577e

      SHA1

      89217bb67dbab064b958f86c8e65be95cac47fdd

      SHA256

      6b1320117d8bef68a7695d98c797c5acf66c517d0a3873c24234118ffaa021c4

      SHA512

      be5aa5af95ba26ba41d1ace845a6cdeed79d91d71a6ae68881f2de6201c73aa6d643875ecd4ededf9135f6ad9363ad03c84df90c7c24ffa3f6967f2abb2948d8

      Download Submit

    • C:\sys.exe
      Filesize

      132KB

      MD5

      ee567dadd1ccb0ea82993f062328a113

      SHA1

      20224d489c76b7bf11cc664c711959759d7d17a7

      SHA256

      e3ade3c3b28d89a18532e4b8b42a0f61035dcb55fab4414ce4eb0a76b20b9686

      SHA512

      619d69c6a81eb5499525460710e7e86b539d63f6a10bc9a830296b396b68c63651a152595afd295b50ac0b68681c21bb7a090f653a82023813a021c7740aa35f

      Download Submit

    • \??\c:\sys.exe
      Filesize

      132KB

      MD5

      ee567dadd1ccb0ea82993f062328a113

      SHA1

      20224d489c76b7bf11cc664c711959759d7d17a7

      SHA256

      e3ade3c3b28d89a18532e4b8b42a0f61035dcb55fab4414ce4eb0a76b20b9686

      SHA512

      619d69c6a81eb5499525460710e7e86b539d63f6a10bc9a830296b396b68c63651a152595afd295b50ac0b68681c21bb7a090f653a82023813a021c7740aa35f

      Download Submit