joker | 1634cd31bc5c8b50aa4efe86d8c5611cc15d2f6d7e9a4441d059189e1efd1cf5

Analysis

max time kernel
154s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cf13e6374b590864851a7d078c6c0ca.exe
Size

132KB
MD5

4cf13e6374b590864851a7d078c6c0ca
SHA1

7af06765aa146779df01a40dfa95eb666237205c
SHA256

1634cd31bc5c8b50aa4efe86d8c5611cc15d2f6d7e9a4441d059189e1efd1cf5
SHA512

06b6f67f054976d19b6dee7e6d6fb5181dd79450f10becf33e58251a482c1be969f6207138d8a8800ec80b827030b98da233628b42873d9993ca56f113f35c93
SSDEEP

3072:z1i/NU8bOMYcYYcmy5K/40g3nan3vx9kGSYng76s5YmMOMYcYY51i/NU8m:Bi/NjO5u//g+UGSYnum3Oai/Nu

Score

10^/10

joker infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
2024	sys.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	sys.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe"	sys.exe

Deletes itself 1 IoCs

pid	Process
2008	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	sys.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	sys.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\sys.exe	4cf13e6374b590864851a7d078c6c0ca.exe
File opened for modification	C:\WINDOWS\sys.exe	4cf13e6374b590864851a7d078c6c0ca.exe
File created	C:\WINDOWS\sys.exe	sys.exe
File opened for modification	C:\WINDOWS\sys.exe	sys.exe
File opened for modification	C:\WINDOWS\sys.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1004	taskkill.exe
952	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\ = "63"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000000ac26d0bd7279a77c671dbc6e5fd9fc778d84bfcb14e6eede46edf7c9a2a6896000000000e8000000002000020000000407b25828117dcc8ec5f2fb7cf079c6504615e6c090ffa6b151d09a6c2d0858290000000ace3f4f6ab97cbd20c814e281d55d1e238da83e58cdb435ab1454c0638fd8e3f638f2f79fda8af72aad3f85ade111e4930740968e01d2a239aa64fd4d3010e228b0544c9f2bffb44a8b48d0b68b071a6b02e9aa1d304dd5c0fee17f61b96cac253f7fe276587b8990ec0ff724b2b2b3b60f16c03a1fa15f4265a478ca17b03e41c607111b35a55fe4e5589f210b1f9b040000000887f450bd1b9ca19ea8ab74dcb177561750d55722a28a92a78694e20e9109ba8a31ebdc66f80aa9356ae1bcc16560d29868d057a09fa18e51920a2bb6ff1a47f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369861932"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\ymtuku.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000007d00515b0d6dc90ced5ddfac50d8f1f26f67fcfb9bca0f549def842835e81ba0000000000e80000000020000200000004b19fb3e3a705033c105407859a2ebf4f4989920aa706648a57725cdfe3f0947200000000b2370b38c04de21da60d80204f404d94978943d98704dd2d10b0acc0e7f00f8400000003d4811a4ff8ec7270fd5330dc0610cde2536cecb5bced49a0ccb71630b5476ed679eb22e0604bfb281388497603a098a8f3187de4db28e01817b38b9d9184de5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ymtuku.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C62AB91-3915-11ED-9AD4-7A3897842414} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a056a27e22cdd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\154.203.154.173	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	sys.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ymtuku.com\ = "63"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	sys.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	sys.exe
2024	sys.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
868	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1884	4cf13e6374b590864851a7d078c6c0ca.exe
2024	sys.exe
868	iexplore.exe
868	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1004	1884	4cf13e6374b590864851a7d078c6c0ca.exe	28
PID 1884 wrote to memory of 1004	1884	4cf13e6374b590864851a7d078c6c0ca.exe	28
PID 1884 wrote to memory of 1004	1884	4cf13e6374b590864851a7d078c6c0ca.exe	28
PID 1884 wrote to memory of 1004	1884	4cf13e6374b590864851a7d078c6c0ca.exe	28
PID 1884 wrote to memory of 2024	1884	4cf13e6374b590864851a7d078c6c0ca.exe	30
PID 1884 wrote to memory of 2024	1884	4cf13e6374b590864851a7d078c6c0ca.exe	30
PID 1884 wrote to memory of 2024	1884	4cf13e6374b590864851a7d078c6c0ca.exe	30
PID 1884 wrote to memory of 2024	1884	4cf13e6374b590864851a7d078c6c0ca.exe	30
PID 1884 wrote to memory of 2008	1884	4cf13e6374b590864851a7d078c6c0ca.exe	31
PID 1884 wrote to memory of 2008	1884	4cf13e6374b590864851a7d078c6c0ca.exe	31
PID 1884 wrote to memory of 2008	1884	4cf13e6374b590864851a7d078c6c0ca.exe	31
PID 1884 wrote to memory of 2008	1884	4cf13e6374b590864851a7d078c6c0ca.exe	31
PID 2024 wrote to memory of 952	2024	sys.exe	33
PID 2024 wrote to memory of 952	2024	sys.exe	33
PID 2024 wrote to memory of 952	2024	sys.exe	33
PID 2024 wrote to memory of 952	2024	sys.exe	33
PID 2024 wrote to memory of 868	2024	sys.exe	35
PID 2024 wrote to memory of 868	2024	sys.exe	35
PID 2024 wrote to memory of 868	2024	sys.exe	35
PID 2024 wrote to memory of 868	2024	sys.exe	35
PID 868 wrote to memory of 568	868	iexplore.exe	38
PID 868 wrote to memory of 568	868	iexplore.exe	38
PID 868 wrote to memory of 568	868	iexplore.exe	38
PID 868 wrote to memory of 568	868	iexplore.exe	38
PID 2024 wrote to memory of 1540	2024	sys.exe	39
PID 2024 wrote to memory of 1540	2024	sys.exe	39
PID 2024 wrote to memory of 1540	2024	sys.exe	39
PID 2024 wrote to memory of 1540	2024	sys.exe	39
PID 1540 wrote to memory of 972	1540	cmd.exe	41
PID 1540 wrote to memory of 972	1540	cmd.exe	41
PID 1540 wrote to memory of 972	1540	cmd.exe	41
PID 1540 wrote to memory of 972	1540	cmd.exe	41
PID 2024 wrote to memory of 632	2024	sys.exe	42
PID 2024 wrote to memory of 632	2024	sys.exe	42
PID 2024 wrote to memory of 632	2024	sys.exe	42
PID 2024 wrote to memory of 632	2024	sys.exe	42
PID 632 wrote to memory of 1484	632	cmd.exe	44
PID 632 wrote to memory of 1484	632	cmd.exe	44
PID 632 wrote to memory of 1484	632	cmd.exe	44
PID 632 wrote to memory of 1484	632	cmd.exe	44
PID 2024 wrote to memory of 1640	2024	sys.exe	45
PID 2024 wrote to memory of 1640	2024	sys.exe	45
PID 2024 wrote to memory of 1640	2024	sys.exe	45
PID 2024 wrote to memory of 1640	2024	sys.exe	45
PID 1640 wrote to memory of 752	1640	cmd.exe	47
PID 1640 wrote to memory of 752	1640	cmd.exe	47
PID 1640 wrote to memory of 752	1640	cmd.exe	47
PID 1640 wrote to memory of 752	1640	cmd.exe	47
PID 2024 wrote to memory of 1676	2024	sys.exe	48
PID 2024 wrote to memory of 1676	2024	sys.exe	48
PID 2024 wrote to memory of 1676	2024	sys.exe	48
PID 2024 wrote to memory of 1676	2024	sys.exe	48
PID 1676 wrote to memory of 1744	1676	cmd.exe	50
PID 1676 wrote to memory of 1744	1676	cmd.exe	50
PID 1676 wrote to memory of 1744	1676	cmd.exe	50
PID 1676 wrote to memory of 1744	1676	cmd.exe	50
PID 2024 wrote to memory of 1740	2024	sys.exe	51
PID 2024 wrote to memory of 1740	2024	sys.exe	51
PID 2024 wrote to memory of 1740	2024	sys.exe	51
PID 2024 wrote to memory of 1740	2024	sys.exe	51
PID 1740 wrote to memory of 1772	1740	cmd.exe	53
PID 1740 wrote to memory of 1772	1740	cmd.exe	53
PID 1740 wrote to memory of 1772	1740	cmd.exe	53
PID 1740 wrote to memory of 1772	1740	cmd.exe	53

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
972	attrib.exe
1484	attrib.exe
752	attrib.exe
1744	attrib.exe
1772	attrib.exe
340	attrib.exe
1000	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4cf13e6374b590864851a7d078c6c0ca.exe
"C:\Users\Admin\AppData\Local\Temp\4cf13e6374b590864851a7d078c6c0ca.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im KSafeTray.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\WINDOWS\sys.exe
  "C:\WINDOWS\sys.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /im KSafeTray.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
      4⤵
      Views/modifies file attributes
      PID:752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
      4⤵
      Views/modifies file attributes
      PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\sys.exe"
    3⤵
    PID:1988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\WINDOWS\sys.exe"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +h "c:\sys.exe"
    3⤵
    PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "c:\sys.exe"
      4⤵
      Views/modifies file attributes
      PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del 4cf13e6374b590864851a7d078c6c0ca.exe
  2⤵
  - Deletes itself
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
6c6a24456559f305308cb1fb6c5486b3

SHA1
3273ac27d78572f16c3316732b9756ebc22cb6ed

SHA256
efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

SHA512
587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b86f035ae27db1b61679f5f46bc2a0ee

SHA1
52eae6f2ede4153b8e61b8070c3865ee1d3b4a28

SHA256
02ff28c083ac86e5a96fd16720e6acfca6624cd188a2cffc2d41d7d34cc18bbc

SHA512
c41bc9d0b2bf947e5b2c22d7dc1541ed79258fa314b1837af6c4be10fe7571fd1a2d53597a222f7342bc9b26350466a086cd917ddd3d4693ee1a6a391657e94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
5KB

MD5
b7575818725635960229f5d576a67617

SHA1
5946cc06041b15ff8b6ea510cb3d98cd4f8d05a9

SHA256
7f365e1e4d0e64c2988dfd57192005b182e07c42db699f43abb412ff329168ef

SHA512
b13343555a9ae7be5f9fab924d49ba867d49ee6d09920295f13aa42f835c74d6e75fdca907bf6ab4e2c2dc82d51dc12b5b138e86166d36fe853ffcaad606ba2d

Download Submit
C:\WINDOWS\sys.exe

Filesize
132KB

MD5
194894f26fc7b6799f5c142d7ef7cdae

SHA1
212ab422b954f1223bd4d107b2a77c3415434c51

SHA256
7d45453a87e0da2a3f3a09d78087dc4379a74c4809d425278849ccef483d70fd

SHA512
9b997d5e98e8cf3542b97da0f3d616aba9aa298e9a0962aa49b67bf9b456fad0b310aa556dd6b88a6e8231abe2695ab65820e9096d2afc6aea1d9f8735d8d17f

Download Submit
C:\Windows\sys.exe

Filesize
132KB

MD5
194894f26fc7b6799f5c142d7ef7cdae

SHA1
212ab422b954f1223bd4d107b2a77c3415434c51

SHA256
7d45453a87e0da2a3f3a09d78087dc4379a74c4809d425278849ccef483d70fd

SHA512
9b997d5e98e8cf3542b97da0f3d616aba9aa298e9a0962aa49b67bf9b456fad0b310aa556dd6b88a6e8231abe2695ab65820e9096d2afc6aea1d9f8735d8d17f

Download Submit
C:\sys.exe

Filesize
132KB

MD5
b1b306f45c3a6deac2c9ff36f8b3b952

SHA1
60f8f2064effbe115afc929915f35a06804f4344

SHA256
246f0f85c89b9bad8e3a55fb158cfa503f3b4ecf592384b5cfb1663c75367e0f

SHA512
471ed24ca31364fb3e414627b40b277c73b1a3af718c5aeb58759c95b14201871b2936d76649ef6f742633ca76beac29805c45572043ba2152d47f92ee16ed3b

Download Submit
\??\c:\sys.exe

Filesize
132KB

MD5
b1b306f45c3a6deac2c9ff36f8b3b952

SHA1
60f8f2064effbe115afc929915f35a06804f4344

SHA256
246f0f85c89b9bad8e3a55fb158cfa503f3b4ecf592384b5cfb1663c75367e0f

SHA512
471ed24ca31364fb3e414627b40b277c73b1a3af718c5aeb58759c95b14201871b2936d76649ef6f742633ca76beac29805c45572043ba2152d47f92ee16ed3b

Download Submit
memory/340-78-0x0000000000000000-mapping.dmp

Download
memory/632-69-0x0000000000000000-mapping.dmp

Download
memory/752-72-0x0000000000000000-mapping.dmp

Download
memory/952-63-0x0000000000000000-mapping.dmp

Download
memory/956-79-0x0000000000000000-mapping.dmp

Download
memory/972-68-0x0000000000000000-mapping.dmp

Download
memory/1000-80-0x0000000000000000-mapping.dmp

Download
memory/1004-56-0x0000000000000000-mapping.dmp

Download
memory/1484-70-0x0000000000000000-mapping.dmp

Download
memory/1540-67-0x0000000000000000-mapping.dmp

Download
memory/1640-71-0x0000000000000000-mapping.dmp

Download
memory/1676-73-0x0000000000000000-mapping.dmp

Download
memory/1740-75-0x0000000000000000-mapping.dmp

Download
memory/1744-74-0x0000000000000000-mapping.dmp

Download
memory/1772-76-0x0000000000000000-mapping.dmp

Download
memory/1884-57-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1988-77-0x0000000000000000-mapping.dmp

Download
memory/2008-60-0x0000000000000000-mapping.dmp

Download
memory/2024-58-0x0000000000000000-mapping.dmp

Download