joker | 9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe
Size

33KB
MD5

6d6df4c946be2b521855e1025eb8921f
SHA1

05fcfd8d87f385cfc271d7463946563e4e41af6e
SHA256

9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f
SHA512

a7a0d64c31122ea70aa9ae53f8d62d9524061663b933d4f0b8bbe9ab02280caa3587edbe4eff7bc8d0c56b50101623d40489d3adf68621ea70e3f65b7296b38d
SSDEEP

384:i401dRPExlCDAzGPeRUckO0nJCBlPfPU8fMyc3Qts706xIduUy1ay8hmYNek+vvw:i4URzuR4O0kHXPjKOuRcy8hmmlfR3

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
4720	inl4860.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3092	attrib.exe
3180	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fsahdsf = "\"C:\\Users\\Admin\\AppData\\Roaming\\lua\\tmp.\\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1624	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu462.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu462.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1448165124"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1484398142"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1447992848"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu462.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987882"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987882"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{815AC87E-425D-11ED-AECB-7ED4F7B3352B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu462.site	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu462.site\NumberOfSubdomains = "1"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?S"	reg.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\lua\\3.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\NeverShowExt	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3996	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeIncBasePriorityPrivilege	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3660	iexplore.exe
3660	iexplore.exe
4888	IEXPLORE.EXE
4888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1188	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	88
PID 5012 wrote to memory of 1188	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	88
PID 5012 wrote to memory of 1188	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	88
PID 1188 wrote to memory of 4668	1188	cmd.exe	91
PID 1188 wrote to memory of 4668	1188	cmd.exe	91
PID 1188 wrote to memory of 4668	1188	cmd.exe	91
PID 4668 wrote to memory of 3660	4668	cmd.exe	92
PID 4668 wrote to memory of 3660	4668	cmd.exe	92
PID 4668 wrote to memory of 1736	4668	cmd.exe	93
PID 4668 wrote to memory of 1736	4668	cmd.exe	93
PID 4668 wrote to memory of 1736	4668	cmd.exe	93
PID 4668 wrote to memory of 3204	4668	cmd.exe	94
PID 4668 wrote to memory of 3204	4668	cmd.exe	94
PID 4668 wrote to memory of 3204	4668	cmd.exe	94
PID 5012 wrote to memory of 4720	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	96
PID 5012 wrote to memory of 4720	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	96
PID 5012 wrote to memory of 4720	5012	9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe	96
PID 3204 wrote to memory of 3996	3204	cmd.exe	97
PID 3204 wrote to memory of 3996	3204	cmd.exe	97
PID 3204 wrote to memory of 3996	3204	cmd.exe	97
PID 3660 wrote to memory of 4888	3660	iexplore.exe	98
PID 3660 wrote to memory of 4888	3660	iexplore.exe	98
PID 3660 wrote to memory of 4888	3660	iexplore.exe	98
PID 3204 wrote to memory of 4396	3204	cmd.exe	99
PID 3204 wrote to memory of 4396	3204	cmd.exe	99
PID 3204 wrote to memory of 4396	3204	cmd.exe	99
PID 3204 wrote to memory of 2972	3204	cmd.exe	100
PID 3204 wrote to memory of 2972	3204	cmd.exe	100
PID 3204 wrote to memory of 2972	3204	cmd.exe	100
PID 3204 wrote to memory of 2300	3204	cmd.exe	101
PID 3204 wrote to memory of 2300	3204	cmd.exe	101
PID 3204 wrote to memory of 2300	3204	cmd.exe	101
PID 3204 wrote to memory of 3180	3204	cmd.exe	102
PID 3204 wrote to memory of 3180	3204	cmd.exe	102
PID 3204 wrote to memory of 3180	3204	cmd.exe	102
PID 3204 wrote to memory of 3092	3204	cmd.exe	103
PID 3204 wrote to memory of 3092	3204	cmd.exe	103
PID 3204 wrote to memory of 3092	3204	cmd.exe	103
PID 3204 wrote to memory of 2296	3204	cmd.exe	104
PID 3204 wrote to memory of 2296	3204	cmd.exe	104
PID 3204 wrote to memory of 2296	3204	cmd.exe	104
PID 3204 wrote to memory of 1624	3204	cmd.exe	105
PID 3204 wrote to memory of 1624	3204	cmd.exe	105
PID 3204 wrote to memory of 1624	3204	cmd.exe	105
PID 2296 wrote to memory of 1380	2296	rundll32.exe	106
PID 2296 wrote to memory of 1380	2296	rundll32.exe	106
PID 2296 wrote to memory of 1380	2296	rundll32.exe	106
PID 1380 wrote to memory of 568	1380	runonce.exe	107
PID 1380 wrote to memory of 568	1380	runonce.exe	107
PID 1380 wrote to memory of 568	1380	runonce.exe	107
PID 3204 wrote to memory of 5024	3204	cmd.exe	109
PID 3204 wrote to memory of 5024	3204	cmd.exe	109
PID 3204 wrote to memory of 5024	3204	cmd.exe	109
PID 3204 wrote to memory of 5040	3204	cmd.exe	110
PID 3204 wrote to memory of 5040	3204	cmd.exe	110
PID 3204 wrote to memory of 5040	3204	cmd.exe	110
PID 3204 wrote to memory of 4580	3204	cmd.exe	111
PID 3204 wrote to memory of 4580	3204	cmd.exe	111
PID 3204 wrote to memory of 4580	3204	cmd.exe	111
PID 3204 wrote to memory of 2840	3204	cmd.exe	112
PID 3204 wrote to memory of 2840	3204	cmd.exe	112
PID 3204 wrote to memory of 2840	3204	cmd.exe	112
PID 3204 wrote to memory of 4988	3204	cmd.exe	114
PID 3204 wrote to memory of 4988	3204	cmd.exe	114

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3180	attrib.exe
3092	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe
"C:\Users\Admin\AppData\Local\Temp\9b6ed840c999b7681d4891d363a7f442195b0bca8b00da80f24ad2a600f6170f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3660 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4888
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /t REG_SZ /d .bat /f
        5⤵
        Modifies registry key
        
        PID:3996
    - - C:\Windows\SysWOW64\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:4396
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:2972
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:2300
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3180
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3092
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2296
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:568
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "360tray.exe" tasklist.txt
        5⤵
        
        PID:5024
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:5040
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:4580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile" /v "NeverShowExt" /d "" /f
        5⤵
        Modifies registry class
        
        PID:2840
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile\DefaultIcon" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE" /f
        5⤵
        Modifies registry class
        
        PID:4988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.71628.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1424
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.71628.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2908
- C:\Users\Admin\AppData\Local\Temp\inl4860.tmp
  C:\Users\Admin\AppData\Local\Temp\inl4860.tmp
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9B6ED8~1.EXE > nul
  2⤵
  PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fd70739fca5345a28f924f9102ae10ee

SHA1
6ce3f92183544f3bf52cb76364591589cb940a19

SHA256
f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

SHA512
a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
ca2282b6565e2f7bd122d8ce2acab15b

SHA1
58eab887fe348b827c244182411310703bfe8f7c

SHA256
f55d083bbb2e444f6d58c5f9e1fd4de60a7706d38528343d19b07cdd1ecc192b

SHA512
c59fc47a17e7fc6745de53c3026f0e11f889e85c2428cb1f05288ff98ad357fdb0a0e3cb4671364e79c122da3e5decdf5b20851ebfda322c77ca88b376e58dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

Filesize
1KB

MD5
a1f549b0aa63786ce824eaca5590abe1

SHA1
5eb1515155223826e6746d472d46076a3ca402c1

SHA256
5d488055cfdd15682533c3345aab88ed300c8eff727087062dd3b4b55fa301b0

SHA512
e6bb2a338c0cd07cc096c0f9e49ebfbf067614e9d80a4554e161d54e79c64c5bdb93b9b50fd4a6c17624349b28676c10202e47f0c07b80dea2f982d65d26d488

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
891B

MD5
e85f8bd6b3138dc11e6790c3280d261e

SHA1
59dddb6b50d10da9899a892a3510640f3377dc88

SHA256
6dba32f48a5e925d57c686c13919bbd463d8f792e1117e157c999787e3b98edf

SHA512
32a4e73fae1336a1a2225fd5d654e4b89b457fd70073f44463c0059e665d63e2bd20ccde58223f1e548ce81c7ea7d86c8e2a291144ca88b578e70660c64fcf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl4860.tmp

Filesize
57.2MB

MD5
efab1c9e3ce7457db207f19a13e94902

SHA1
1cd039333d091b897468d1d6568fda1d66ab7a69

SHA256
5a84344b72de5091260f0d862eb888c57896724ecb0a2b38ccc62a011e33b725

SHA512
3f29c06c522fc2d24893e606cd43000c22bb09d22e0542f6d81fe10d2c7df06ae341c58b08ee035dcdcd45fd651da63176d4ef60e1e192ab3280e61aadd917db

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl4860.tmp

Filesize
57.2MB

MD5
efab1c9e3ce7457db207f19a13e94902

SHA1
1cd039333d091b897468d1d6568fda1d66ab7a69

SHA256
5a84344b72de5091260f0d862eb888c57896724ecb0a2b38ccc62a011e33b725

SHA512
3f29c06c522fc2d24893e606cd43000c22bb09d22e0542f6d81fe10d2c7df06ae341c58b08ee035dcdcd45fd651da63176d4ef60e1e192ab3280e61aadd917db

Download Submit
C:\Users\Admin\AppData\Local\Temp\tasklist.txt

Filesize
7KB

MD5
2d64a53d43c779e118bb4a040267baac

SHA1
8c1a54d4eddedb1d0c06301ddbc61e7a6c8ba8cd

SHA256
f6ac9257e00937a6069af6c25f54a7738813ee8f62183ebb437c16b0ee0f820c

SHA512
04676669280e24a48239f990611f1c1a9a70893af994644f0130ecd29794b8f6e09969a1bb257414c80091ea9a39557c8c3f4dd2c941b0295de0b96b7bdc103c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

Filesize
50B

MD5
e08ad52d3d132292f9c51e7cfec5fe08

SHA1
269f7eb185a9ff02664297bfb6f5df9f86ec10f0

SHA256
bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

SHA512
3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.bat

Filesize
2KB

MD5
d056542458b3c68eab3836776c463f55

SHA1
932645c2e4b5368f1b9bd008bfc78ea8e4b5db96

SHA256
544cccea14c7f3c5bf02addc31001c6d1a498364c791fc0b0dad3707ec9b26ef

SHA512
808f01ed508000852a3984849adb1eeae3f0f51bacada9dffad6628d3ba4bb3ca20ad7a6e832030d32a7fd68a73b6baa4554e707d01a74da2517addfd9d892f3

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.bat

Filesize
8KB

MD5
4f84754b116c25f54d51899f231c8374

SHA1
aee83005525334a2baf308f72ca5028504e92f3d

SHA256
63f34f232b426a16700f3575c01f5e8638d745e3af952401539f9fa906347308

SHA512
f825f3fec7b7bb56d31197a8a36b2cecd85526ca2c34f94118d1ab8be60dd0eb508fa9f50f769b6407db721a02aeb8b065430c27dae0835726c74fd86af24996

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.inf

Filesize
244B

MD5
2de3e6e4faea8c4a10ddd4f26455caca

SHA1
b7c02274aa020619e6c7b925427b027ffcc28629

SHA256
9f29d64886130752a5fe40ce6e83a8f35dc65340871cfe435499a609037c2824

SHA512
0e49cbd89766d3697ce4c9a2c83de32ebaee2d41f1a635a94cf0c73541aaa614f4f5b755f55d21fdea07fc76985bc741f2649abc1c6a32e9876ffa6b3a1c33c8

Download Submit
memory/3660-155-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-201-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-165-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-164-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-158-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-167-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-168-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-169-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-154-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-171-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-173-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-231-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-178-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-177-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-230-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-179-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-181-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-182-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-183-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-184-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-185-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-189-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-190-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-191-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-192-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-193-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-198-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-199-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-200-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-162-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-202-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-203-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-205-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-225-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-153-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-152-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-151-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-149-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-148-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-145-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-146-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-142-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/3660-143-0x00007FF87EE80000-0x00007FF87EEEE000-memory.dmp

Filesize
440KB

Download
memory/5012-224-0x0000000000570000-0x0000000000585000-memory.dmp

Filesize
84KB

Download
memory/5012-132-0x0000000000570000-0x0000000000585000-memory.dmp

Filesize
84KB

Download
memory/5012-135-0x0000000000570000-0x0000000000585000-memory.dmp

Filesize
84KB

Download
memory/5012-134-0x0000000000830000-0x0000000000833000-memory.dmp

Filesize
12KB

Download
memory/5012-133-0x0000000000830000-0x0000000000833000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads