Analysis
-
max time kernel
101s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 03:14
Static task
static1
Behavioral task
behavioral1
Sample
c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe
Resource
win10v2004-20220812-en
General
-
Target
c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe
-
Size
1.1MB
-
MD5
553abcaba9f2201c6be0288d2a28e7d8
-
SHA1
b7ebb6b0d9aa6aa7372eefc843709ad4b61e9ca8
-
SHA256
c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a
-
SHA512
3d65b6fc12db4bb74568ebbbc6cded9a40857f3b1dcfe3dc6c793eb9128efe09b92eda4c8aa7aced65bb2f085225e83c41b002f51147f1c5d39c75999ee4c6d2
-
SSDEEP
24576:EEsZg89x5NU+wnzihMeDfWmASWKBzTXBfxztO9gKuFHmed2dEvZBfrYw8I:EEsJnEevhTHZOyKOHmevZtcA
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.2dama.com c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\2dama.com c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2dama.com\Total = "63" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2dama.com\ = "126" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2dama.com\Total = "126" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2dama.com\NumberOfSubdomains = "1" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\2dama.com c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.2dama.com\ = "63" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ProgID c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F} c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\LocalServer32 c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.GHSProtocol\Clsid c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ProgID\ = "c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.GHSProtocol" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ = "Embedded Async Pluggable Protocol" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.GHSProtocol c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.GHSProtocol\ = "Embedded Async Pluggable Protocol" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.GHSProtocol\Clsid\ = "{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}" c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4948 c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe 4948 c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe"C:\Users\Admin\AppData\Local\Temp\c7c546e948d99a7f5abc02b022b5e2836630191b0a8da86e4179794e60c86b4a.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4948