Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 23:47

General

  • Target

    a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe

  • Size

    1.8MB

  • MD5

    02f813c6b622223a466d802718ff6cbc

  • SHA1

    734d0bb7aa3a3a0dc2361b8e030050b30f2c4679

  • SHA256

    a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3

  • SHA512

    c6078cccb314792e281d3edddf6b6fdffe29d95491d139113bff07e2534d0a3ac953a0c418c59b495c2c304e640d1c707f686c857f68b077dda3cb81a8ad837d

  • SSDEEP

    24576:zMb5VwldaJxVkUDIUVUubQwE2qr2dHlz8M3PcFikGQp0MIzSgMs2SF1P:z45immUDIUVUucwE3KzbHQp0WtSF

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe
    "C:\Users\Admin\AppData\Local\Temp\a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\WINDOWS\nz92.exe
      C:\WINDOWS\nz92.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Windows\SysWOW64\WinHvqf32.exe
        "C:\Windows\system32\WinHvqf32.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\WINHVQ~1.EXE > nul
          4⤵
            PID:1552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\WINDOWS\nz92.exe > nul
          3⤵
            PID:996
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.cfmimang.com/
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:640
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:275457 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2028

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        60KB

        MD5

        d15aaa7c9be910a9898260767e2490e1

        SHA1

        2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

        SHA256

        f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

        SHA512

        7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        67166fbc476ebd1ff59473871e412752

        SHA1

        4fab0e9663a084e2da87c1abfbc6d3764c0f1203

        SHA256

        575772abfa8eec65bec956658a1ed1698837a5d3a24b2aa0251d299c96129ac9

        SHA512

        c112087e855d56b5f039c762f2483a67cc37a075c2176dcdf3bb7aa6b433d2c8ddb7d256984a171b244a5620604f800012ad6c64b3b82a834f75f05759dda65a

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

        Filesize

        5KB

        MD5

        2cdc9fd6fe311a8a913e34443f5a7d14

        SHA1

        32e4d0745964385f4a388e0a52228b45ad1676f6

        SHA256

        d641e78a5fe336b43e069c337e9e7f3d00ca1dd04a535f8a698f7d357b17274e

        SHA512

        d28b201f108296120006797211219426cd283da46ae161eb6f081441adc3788a3f5362b7090abcc49230303ced425cef65cbee8e0348664526fede69d06fd2a2

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V77RP3HD.txt

        Filesize

        608B

        MD5

        fb3145cdce3079a31c388b038c8d2f00

        SHA1

        da343040cacce90cdc4a27edb351548a140a1e01

        SHA256

        a36abaa652441d41274f21e49343a9a0477c92f65186176f71dbee12107d8c93

        SHA512

        6b0a12f83054aac221d6e7fdac96768a7f81753a5f24178972591b71f3615d36666da61851fb8b36a064809b935e1444b42589aaa4bf84905c7c488a17fdb921

      • C:\WINDOWS\nz92.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • C:\Windows\SysWOW64\WinHvqf32.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • C:\Windows\SysWOW64\WinHvqf32.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • C:\Windows\nz92.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • \Windows\SysWOW64\WinHvqf32.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • \Windows\SysWOW64\WinHvqf32.exe

        Filesize

        17KB

        MD5

        c7677623e4429d99e90ce71e90813c9d

        SHA1

        98498570715bd76735a08377a1cbf008780a3065

        SHA256

        68039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267

        SHA512

        f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f

      • memory/1308-70-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-72-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-76-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-80-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-84-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-82-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-88-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-90-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-86-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-92-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-94-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-98-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-96-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-101-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-55-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-78-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-74-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

        Filesize

        8KB

      • memory/1308-68-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-66-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-64-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-62-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-60-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-58-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-114-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-59-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

      • memory/1308-57-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB