joker | 6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2022 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe
Size

54KB
MD5

74f43f100c362d82d77cfcaff27ebf8c
SHA1

397b9ad8925b11b9a42baf3119e0e31126fc3442
SHA256

6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef
SHA512

337a356880329ee250e2b6208fcf625e345a64a18c48b17048d90d9dab0c2ae677543f5284dda5228b7087d432362248ff3de59c4f4d59a7c6a1b7397b26b164
SSDEEP

768:gNh5DfiT2+IXeIt1wgOP+kw+tNwsxQkHPrz+N35yKNQbJItygam7RIEMrOQYz0+Y:gZWKJJMguNNdxzHni3gkkJIv7R9wg0aE

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
3672	inlF917.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4604	attrib.exe
4204	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\datread\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu2222.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990211"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1452A350-4B77-11ED-B696-DEF0885D2AEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu2222.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990211"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990211"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3973553787"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu2222.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu2222.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3917146797"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu2222.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3917146797"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\datread\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3376	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3376	iexplore.exe
3376	iexplore.exe
5104	IEXPLORE.EXE
5104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2112	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	86
PID 5072 wrote to memory of 2112	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	86
PID 5072 wrote to memory of 2112	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	86
PID 2112 wrote to memory of 2060	2112	cmd.exe	89
PID 2112 wrote to memory of 2060	2112	cmd.exe	89
PID 2112 wrote to memory of 2060	2112	cmd.exe	89
PID 2060 wrote to memory of 3376	2060	cmd.exe	91
PID 2060 wrote to memory of 3376	2060	cmd.exe	91
PID 2060 wrote to memory of 3412	2060	cmd.exe	93
PID 2060 wrote to memory of 3412	2060	cmd.exe	93
PID 2060 wrote to memory of 3412	2060	cmd.exe	93
PID 2060 wrote to memory of 4480	2060	cmd.exe	94
PID 2060 wrote to memory of 4480	2060	cmd.exe	94
PID 2060 wrote to memory of 4480	2060	cmd.exe	94
PID 4480 wrote to memory of 4520	4480	cmd.exe	96
PID 4480 wrote to memory of 4520	4480	cmd.exe	96
PID 4480 wrote to memory of 4520	4480	cmd.exe	96
PID 4480 wrote to memory of 696	4480	cmd.exe	97
PID 4480 wrote to memory of 696	4480	cmd.exe	97
PID 4480 wrote to memory of 696	4480	cmd.exe	97
PID 4480 wrote to memory of 1796	4480	cmd.exe	98
PID 4480 wrote to memory of 1796	4480	cmd.exe	98
PID 4480 wrote to memory of 1796	4480	cmd.exe	98
PID 4480 wrote to memory of 4824	4480	cmd.exe	99
PID 4480 wrote to memory of 4824	4480	cmd.exe	99
PID 4480 wrote to memory of 4824	4480	cmd.exe	99
PID 4480 wrote to memory of 2260	4480	cmd.exe	100
PID 4480 wrote to memory of 2260	4480	cmd.exe	100
PID 4480 wrote to memory of 2260	4480	cmd.exe	100
PID 4480 wrote to memory of 4604	4480	cmd.exe	101
PID 4480 wrote to memory of 4604	4480	cmd.exe	101
PID 4480 wrote to memory of 4604	4480	cmd.exe	101
PID 4480 wrote to memory of 4204	4480	cmd.exe	102
PID 4480 wrote to memory of 4204	4480	cmd.exe	102
PID 4480 wrote to memory of 4204	4480	cmd.exe	102
PID 3376 wrote to memory of 5104	3376	iexplore.exe	103
PID 3376 wrote to memory of 5104	3376	iexplore.exe	103
PID 3376 wrote to memory of 5104	3376	iexplore.exe	103
PID 5072 wrote to memory of 3672	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	104
PID 5072 wrote to memory of 3672	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	104
PID 5072 wrote to memory of 3672	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	104
PID 4480 wrote to memory of 2720	4480	cmd.exe	105
PID 4480 wrote to memory of 2720	4480	cmd.exe	105
PID 4480 wrote to memory of 2720	4480	cmd.exe	105
PID 4480 wrote to memory of 4252	4480	cmd.exe	106
PID 4480 wrote to memory of 4252	4480	cmd.exe	106
PID 4480 wrote to memory of 4252	4480	cmd.exe	106
PID 2720 wrote to memory of 3024	2720	rundll32.exe	107
PID 2720 wrote to memory of 3024	2720	rundll32.exe	107
PID 2720 wrote to memory of 3024	2720	rundll32.exe	107
PID 5072 wrote to memory of 3804	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	108
PID 5072 wrote to memory of 3804	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	108
PID 5072 wrote to memory of 3804	5072	6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe	108
PID 3024 wrote to memory of 1168	3024	runonce.exe	110
PID 3024 wrote to memory of 1168	3024	runonce.exe	110
PID 3024 wrote to memory of 1168	3024	runonce.exe	110

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4604	attrib.exe
4204	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe
"C:\Users\Admin\AppData\Local\Temp\6843be9096f449019023fc8c91a01225e85732bbbbb711ead33d03d8e1a115ef.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://wWW.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5104
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\1.inf
      4⤵
      PID:3412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4520
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:696
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:1796
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:4824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\datread\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:2260
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4604
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4204
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:1168
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:4252
- C:\Users\Admin\AppData\Local\Temp\inlF917.tmp
  C:\Users\Admin\AppData\Local\Temp\inlF917.tmp
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6843BE~1.EXE > nul
  2⤵
  PID:3804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
60c5dda6c87529c1fdbe874fd534913b

SHA1
141dd530c67ebdac9998a8f253aede034519ebbb

SHA256
c210d69c28a4a6abb399a425ffb66797df7c3fcf3bfc9eab0bf0dc7e19fc84ee

SHA512
bfd86d9e0ee15f5b183070573cfd693e83ce1083aa9c061ce9e68ed0f38518352ccd11b5f78a4b9179bccbed6dad89ee2003b414fbc1e20cf835af7c57b232c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
3e89062c96230ea45f6d30da0bb33513

SHA1
df4bf3f9be21e337be8d9316a43dfe98935e8331

SHA256
adf746a591b716fd23b7614461a0462d6d29d0a2834a8079813a46640ad04c62

SHA512
823ddec4fe239640e01f34d031f8a7180d05ae4aa43bcfd38315ddda68bca6dd84a60133ceeb1088313d6ca09a563bee8937f253ff4be12294d2c589e0d9c84b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
858B

MD5
d727e34e3f5eb5ee1ce17fe4c66bf617

SHA1
ea796e8b305510775d244f30758e125a01569626

SHA256
d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d

SHA512
ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat

Filesize
54B

MD5
5dd457b845e53fce36e6b543764337e4

SHA1
eb7f8ce82274afa5702b20eb5ba133bb71bcb8d6

SHA256
0a2c605c32f2e9b3eda6f18df3d8c1fc2d87922b9bb23d6c3a9de3aa3f383992

SHA512
0fea97ddf333c178ca4805fc85f8b66f81a7906d1cc7bf440206aff50cc711643e90115f046077a323b3cc78deeb704f7eb8a934d0a1cd011f6a3ad67057c9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlF917.tmp

Filesize
57.2MB

MD5
fa5be8ced457ebe31aab8a92b76132cf

SHA1
5ade88fec99ca227122870fb9c024ac8b89051be

SHA256
48b05d1b995cacbf75ab686131e71776a22273e831ab491f60fdf1b37ac2653f

SHA512
37e2c72bfa3712ccb1cd29b65b4a68723427f5dcc922b9aac25475e0f4d0066459fc23b73e1fc2ab2a269dee7af3a79489a5e61004823703f9430c748a15f73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlF917.tmp

Filesize
57.2MB

MD5
fa5be8ced457ebe31aab8a92b76132cf

SHA1
5ade88fec99ca227122870fb9c024ac8b89051be

SHA256
48b05d1b995cacbf75ab686131e71776a22273e831ab491f60fdf1b37ac2653f

SHA512
37e2c72bfa3712ccb1cd29b65b4a68723427f5dcc922b9aac25475e0f4d0066459fc23b73e1fc2ab2a269dee7af3a79489a5e61004823703f9430c748a15f73b

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.bat

Filesize
3KB

MD5
70c32a548388769424935af37d73cabc

SHA1
2411e148d5bc6b82403e1d7491293810ba76c8a2

SHA256
bd69b2f6f82d1ef3e608423e03c51f40290bdc9e6c2c27b72fa068ca2a9fb8ee

SHA512
785184d29875bb7c89f0bc3ed6ed00bab3cc919af42af0a8e34c05b948be2e14a33b2256a7e6083325571b55e4a19321666fe6243909dd6e96ad9bf0767bf006

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.bat

Filesize
3KB

MD5
2dccbc7c9d8e6493c16fab45e323b10c

SHA1
b64f49270de7be232bfdce99cd7670af82baf73e

SHA256
36b2154f812901d1b2dc99d91c960a012a30411fc8b39fa32c74157fef53d3f7

SHA512
90e03bad493dc480f9d6bc976bf9028589522f3b04c5dd0222efffea4b237941b0e594ba51e880c657945c80ff80bb136d6caae6b3841398e9753c7fa47c3f3a

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.inf

Filesize
248B

MD5
c5eaacddf7fe93d130f1eb67f3fc2d9d

SHA1
ce20a3a2d9925fa4672884ffda2ee200c06ad7ce

SHA256
c740a578ef5867e18bc914ef724c8258a324b4f35591690e91329a10d17f6b45

SHA512
1f9529123cf74f1c53f75d81b9b6dabb127fcef0067c104c5ca044e28450083fa379c256d63d07d4e4053f197c24e02f9e2ab4507f8bb1068032598b52bbbf77

Download Submit
C:\Users\Admin\AppData\Roaming\datread\4.bat

Filesize
5.8MB

MD5
837ffe2ca51fe1313209cb170015b5a0

SHA1
7b8b42e46db46c95d384ca45abe3e1e172daa2e4

SHA256
5ed749568753ccd08e824cabf569b8fe22c6c61c38fa7573d6dcc94563eef164

SHA512
8c5f1408ad5fddf936acedd5ba6a45ab7a2dd6f2c4b0fc154977d63293b09c52aa0714637253836b8eece1cded8115e9119c2b4ea361dc7fd50eafa25698fdb3

Download Submit
memory/3376-175-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-204-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-152-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-155-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-151-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-157-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-159-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-160-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-162-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-164-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-150-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-166-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-148-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-168-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-169-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-224-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-147-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-223-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-173-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-218-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-211-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-179-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-180-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-212-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-182-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-146-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-145-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-143-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-213-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-215-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-217-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-140-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-190-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-191-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-214-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-210-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-194-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-195-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-197-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-201-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-202-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-203-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/3376-205-0x00007FFD3DAB0000-0x00007FFD3DB1E000-memory.dmp

Filesize
440KB

Download
memory/5072-193-0x0000000000120000-0x0000000000145000-memory.dmp

Filesize
148KB

Download
memory/5072-132-0x0000000000120000-0x0000000000145000-memory.dmp

Filesize
148KB

Download
memory/5072-134-0x0000000000120000-0x0000000000145000-memory.dmp

Filesize
148KB

Download
memory/5072-133-0x0000000000BC0000-0x0000000000BC3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads