Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 07:48

General

  • Target

    1778f19d3929858a1e526c0c6829898847f80f7c6b1ffcb48664c6bc833429d5.exe

  • Size

    54KB

  • MD5

    261818df211314545055d4ef20376ea1

  • SHA1

    27c6d607a1a85a78fba7d80a260d880848390ce6

  • SHA256

    1778f19d3929858a1e526c0c6829898847f80f7c6b1ffcb48664c6bc833429d5

  • SHA512

    e7a908f682d7b31dca120bac8dae69f10e159f1b5f6f010f555e509eaeed6d4f921ff653bd2c87c07a0b24addfeb2333928d9aca1a55b3af92420172388c6664

  • SSDEEP

    768:4V+RWrvMLmYmw043hU0rMPi5/iRPz06m8ZlFmfuDljs169UA8BgubrbslFExIiGT:44RWL30043hkPyKHmfuhTUfBxUl1iGGI

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1778f19d3929858a1e526c0c6829898847f80f7c6b1ffcb48664c6bc833429d5.exe
    "C:\Users\Admin\AppData\Local\Temp\1778f19d3929858a1e526c0c6829898847f80f7c6b1ffcb48664c6bc833429d5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_max_bat.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
        3⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
          4⤵
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          PID:4980
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
          4⤵
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          PID:4536
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?S"" /f
          4⤵
            PID:3796
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
            4⤵
            • Modifies registry class
            PID:4568
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
            4⤵
            • Modifies registry class
            PID:3840
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
            4⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:2248
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
            4⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:1564
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
            4⤵
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Windows\SysWOW64\runonce.exe
              "C:\Windows\system32\runonce.exe" -r
              5⤵
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:4560
              • C:\Windows\SysWOW64\grpconv.exe
                "C:\Windows\System32\grpconv.exe" -o
                6⤵
                  PID:1644
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32 D:\VolumeDH\inj.dat,MainLoad
              4⤵
                PID:3608
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3924
                • C:\PROGRA~1\INTERN~1\iexplore.exe
                  C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
                  5⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4456
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:17410 /prefetch:2
                    6⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2072
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
                  5⤵
                    PID:3596
            • C:\Users\Admin\AppData\Local\Temp\inlFC44.tmp
              C:\Users\Admin\AppData\Local\Temp\inlFC44.tmp
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1232
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlFC44.tmp > nul
                3⤵
                  PID:940
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1778F1~1.EXE > nul
                2⤵
                  PID:5024

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\PROGRA~1\INTERN~1\IEFRAME.dll

                Filesize

                5.8MB

                MD5

                605696b88bc9d71ec65aa3a7cf2d0891

                SHA1

                6faa87e4d4dd24ba710f92ca2bc155a144ff3850

                SHA256

                6daf6f43ad58ea5eda6288a9481580f9bf123564e3928e363aab47ad90aacaff

                SHA512

                1e560e83d1c691234948a677e45ae35a58603b17055b3adbae97261706b6fee05c3eb9cbf1c43352102e2a65556dabd692533cb98619e7682d9660180d50d822

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                471B

                MD5

                afc3e2584b32e1e7c23c33e9534089a5

                SHA1

                ea4e2266d010c300621d2287ea60fe3e9a9ee753

                SHA256

                61597f5f937da250a5ed7b4b82867bebc546a5a35c0029982a003b1e9cbd2e7e

                SHA512

                f0e0d20b15bc390292baf0d93d982315afc466ccd2d4e48152ed65af97aed573d5b9e65b2b50925cbcd2e736955dfec4f63de5739cdb1499eb2db5dfc3cc4fe6

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                404B

                MD5

                b4b156c6ba3f778047050eccb37dae77

                SHA1

                9506a9e286019bef3231797cde79755f32989d16

                SHA256

                86d7f2e69b5ccaf735e39d3eb6bcdbd741f6057e5591138908bfb84a6e725aaf

                SHA512

                7717972742cc5ba2447c6f7a4589b67d83b5c2f02c11de4b955aef416778a2215c91c88cf1c84ef66884cb32ee74902c7ba8ea788f07d0c995f33d194b9434e0

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat

                Filesize

                1KB

                MD5

                5d69871166f64facfe6ec7349c3bbc60

                SHA1

                7da886e6f5d5f22071f9cb4a8c5e003fd787d43f

                SHA256

                fca581d34baa41ed5634f9d382585b845c1cf73aa69e563a3c7f340f6c46e285

                SHA512

                201d2708c15970ea994147f425fe902a94bb094093f43386f577487e730a0530a34ffcaa8bc86bdf4f178e52aa09523af801d38e0217cd4c4917f89a4491680c

              • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

                Filesize

                790B

                MD5

                b18422bf438bbb7798280375a7bc0976

                SHA1

                c1b77b35e3a38ff2ad119f25e548beb5ff68c2e2

                SHA256

                ee8709e751067193dccdfe218108bdae6a30919d7b6c860bc848c7cc4b242fa4

                SHA512

                23cb9c74905f514a2bf4ef91afc53ceb08230b3ce68e3eab17bb36c674260d143a7e7105958ff4ed5c2a416bddffb3c7e28dcf8060cbf323c7e4cab71f613176

              • C:\Users\Admin\AppData\Local\Temp\inlFC44.tmp

                Filesize

                57.2MB

                MD5

                8bf62d67a0f925c0f53d3054b17044f0

                SHA1

                465b9676c4ed514a069e00475e8e1027ffacbb13

                SHA256

                2a59bd649cf5f80e097f127ebca5096cf5e2ea29192de160a7682fe2c198503a

                SHA512

                f97751f6fb3dca3e8bc7ce16155c2468b6f7cb221da2fc46b43d57a5486ee69e6e534e942b9322ab485f47f4391820d0874af1bc79beb5fec3852b5774d5851e

              • C:\Users\Admin\AppData\Local\Temp\inlFC44.tmp

                Filesize

                57.2MB

                MD5

                8bf62d67a0f925c0f53d3054b17044f0

                SHA1

                465b9676c4ed514a069e00475e8e1027ffacbb13

                SHA256

                2a59bd649cf5f80e097f127ebca5096cf5e2ea29192de160a7682fe2c198503a

                SHA512

                f97751f6fb3dca3e8bc7ce16155c2468b6f7cb221da2fc46b43d57a5486ee69e6e534e942b9322ab485f47f4391820d0874af1bc79beb5fec3852b5774d5851e

              • C:\Users\Admin\AppData\Local\Temp\start_max_bat.bat

                Filesize

                54B

                MD5

                504490369970f1c0eb580afbcdf91618

                SHA1

                b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

                SHA256

                a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

                SHA512

                5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

              • C:\Users\Admin\AppData\Roaming\redload\1.bat

                Filesize

                3KB

                MD5

                58db0fb8d73a32c0e8057a6f78c16d07

                SHA1

                5cca0167d57e8bc9a8a228134db7456bfedeb63e

                SHA256

                5191c4b522b9dd8369363060d5e03b2728f71c09855daf1ebc418f592c50029a

                SHA512

                829e9da755fdd4c0b0b276ee47775af66f264ac7ae0e8bb8dec1480a038c58cb6d9e9cdd3706ca7b412f6d143ea6e1034da9993220ae0329e1323d9c5c5ab75a

              • C:\Users\Admin\AppData\Roaming\redload\1.inf

                Filesize

                410B

                MD5

                66a1f0147fed7ddd19e9bb7ff93705c5

                SHA1

                9d803c81ea2195617379b880b227892ba30b0bf6

                SHA256

                4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

                SHA512

                cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

              • C:\Users\Admin\AppData\Roaming\redload\2.bat

                Filesize

                3KB

                MD5

                f293c536f7dc7d8be337cb44de8a71ab

                SHA1

                844fe7c9ce444fe59207936f634d5c86de13d94c

                SHA256

                3969055fba747d61ded8692bc282705116db7b228f9199237b6ff109779ba999

                SHA512

                4f5d0e469dd6a986badfe0b6a94cb1f850e9906448a068260614831f85da9dd29b82bab15fbcbab624013f3b075f992f9f361324c8848dd7026a09a169ae80d1

              • C:\Users\Admin\AppData\Roaming\redload\2.inf

                Filesize

                248B

                MD5

                2197ffb407fb3b2250045c084f73b70a

                SHA1

                3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

                SHA256

                a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

                SHA512

                b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

              • C:\Users\Admin\AppData\Roaming\redload\4.bat

                Filesize

                5.8MB

                MD5

                605696b88bc9d71ec65aa3a7cf2d0891

                SHA1

                6faa87e4d4dd24ba710f92ca2bc155a144ff3850

                SHA256

                6daf6f43ad58ea5eda6288a9481580f9bf123564e3928e363aab47ad90aacaff

                SHA512

                1e560e83d1c691234948a677e45ae35a58603b17055b3adbae97261706b6fee05c3eb9cbf1c43352102e2a65556dabd692533cb98619e7682d9660180d50d822

              • memory/3460-134-0x0000000000610000-0x0000000000635000-memory.dmp

                Filesize

                148KB

              • memory/3460-211-0x0000000000610000-0x0000000000635000-memory.dmp

                Filesize

                148KB

              • memory/3460-132-0x0000000000610000-0x0000000000635000-memory.dmp

                Filesize

                148KB

              • memory/3460-133-0x0000000000AA0000-0x0000000000AA3000-memory.dmp

                Filesize

                12KB

              • memory/4456-171-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-193-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-163-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-165-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-166-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-167-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-169-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-168-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-170-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-173-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-174-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-176-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-177-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-178-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-179-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-180-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-182-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-183-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-184-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-186-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-189-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-190-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-191-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-192-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-162-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-194-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-195-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-196-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-200-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-201-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-202-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-203-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-204-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-209-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-225-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-224-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-213-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-212-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-214-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-215-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-216-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-218-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB

              • memory/4456-219-0x00007FFE977F0000-0x00007FFE9785E000-memory.dmp

                Filesize

                440KB