Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2022, 04:34

General

  • Target

    269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe

  • Size

    59KB

  • MD5

    6a1fcbe6ac7fc091844a1257c7fd135f

  • SHA1

    2247ad4f1d3c8c9d0dbe1015aa1aa88b71dfb050

  • SHA256

    269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f

  • SHA512

    a01ec5857eec66cba3f6c4afc818a6423558fa9df1e74cb4def25c0eabcab894d14dea96ba2bcd254c82fc5299d7d4a5cf38aaa519e63fb45a2840703a53e387

  • SSDEEP

    1536:+fomE60xemL6jBBFqcH5AXbHqqt3CI7S5Nr4kRaAg2YC6:+wmx+emLwBBFqcQbLtzsF4cc236

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe
    "C:\Users\Admin\AppData\Local\Temp\269d876a8d8d56515a16699df6245f137c20e49c52c791200fbb1e2533f8124f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\vmwarefusion4.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?71628
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1832
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
          4⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:1536
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:1848
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
            5⤵
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            PID:1140
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
            5⤵
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            PID:1036
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f
            5⤵
              PID:768
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
              5⤵
              • Modifies registry class
              PID:240
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
              5⤵
              • Modifies registry class
              PID:1728
            • C:\Windows\SysWOW64\attrib.exe
              attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
              5⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:1612
            • C:\Windows\SysWOW64\attrib.exe
              attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
              5⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:1484
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
              5⤵
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:1592
              • C:\Windows\SysWOW64\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                6⤵
                • Checks processor information in registry
                PID:1480
                • C:\Windows\SysWOW64\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  7⤵
                    PID:1468
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 D:\VolumeDH\inj.dat,MainLoad
                5⤵
                  PID:1596
          • C:\Users\Admin\AppData\Local\Temp\inl9CFE.tmp
            C:\Users\Admin\AppData\Local\Temp\inl9CFE.tmp
            2⤵
            • Executes dropped EXE
            PID:2276
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\269D87~1.EXE > nul
            2⤵
            • Deletes itself
            PID:2592

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\inl9CFE.tmp

          Filesize

          122.8MB

          MD5

          446abdc1be7e417c8d994757c13b97aa

          SHA1

          231239deb2a22e8ecc98ba9415c203a13d2b338e

          SHA256

          1025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e

          SHA512

          aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518

        • C:\Users\Admin\AppData\Local\Temp\vmwarefusion4.bat

          Filesize

          53B

          MD5

          23962a245f75fe25510051582203aff1

          SHA1

          20832a3a1179bb2730194d2f7738d41d5d669a43

          SHA256

          1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

          SHA512

          dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

        • C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

          Filesize

          660B

          MD5

          d980f89e4088711df685a0aa09e8f5a7

          SHA1

          dde805f4fa5e016e122e4240e20ff844113717d7

          SHA256

          28f62bd59962d06d903ea079466c66985caa306251717235a0d470a1b0f62d09

          SHA512

          fa2a669d846081d71dcada405d3c4bdb92229ba2b4a9f8fd4e461d7c4d51012d3d3b893466f814c8178b9980119703d1a3f7eafeff281a2eb75465e504df9ee9

        • C:\Users\Admin\AppData\Roaming\PPLive\1.bat

          Filesize

          3KB

          MD5

          286fe459674aef6eee17f6ac79a15fdb

          SHA1

          233dc43099c575a67b05fc1076e676324fd6e63d

          SHA256

          872cc596dc1fe6d5a131129bd84c2a76d6874e9c57ab2cd792d4d12b6f014fd2

          SHA512

          c9acc4a134001da76e7ae6aa5ae65ce58501942dfc1f80959ae4db27c06010db753c9d115eedbe0b2b0e30dd5c4dcd1d32816493b053c65cee81d3a343c87314

        • C:\Users\Admin\AppData\Roaming\PPLive\1.inf

          Filesize

          492B

          MD5

          34c14b8530e1094e792527f7a474fe77

          SHA1

          f71c4e9091140256b34c18220d1dd1efab1f301d

          SHA256

          fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

          SHA512

          25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

        • C:\Users\Admin\AppData\Roaming\PPLive\2.bat

          Filesize

          3KB

          MD5

          d4917ae9072a10d8e12ef3b282b25b3b

          SHA1

          bd9ec6c6395997525ec7c15ecca2f115573cc14c

          SHA256

          6f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b

          SHA512

          c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d

        • C:\Users\Admin\AppData\Roaming\PPLive\2.inf

          Filesize

          247B

          MD5

          ca436f6f187bc049f9271ecdcbf348fa

          SHA1

          bf8a548071cfc150f7affb802538edf03d281106

          SHA256

          6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

          SHA512

          d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

        • C:\Users\Admin\AppData\Roaming\PPLive\4.bat

          Filesize

          12.3MB

          MD5

          3ff5e57c33dd4a5010805d9d8a391a03

          SHA1

          311f787c642b2c3d158a2a420ff6617bda563113

          SHA256

          7b18be94bb8d091ede315f28fa6f564c22c1012fa92e85219be6b4d9d19d72ea

          SHA512

          17a5c69d808cf1b749bef41dbdf44a86d57c5eee4ec095e4df545fbe32cb9a620a4ffcfcd1fc00b7f7a2a8370f8297b12091e50f44b0db36c93d724a07257632

        • \Users\Admin\AppData\Local\Temp\inl9CFE.tmp

          Filesize

          122.8MB

          MD5

          446abdc1be7e417c8d994757c13b97aa

          SHA1

          231239deb2a22e8ecc98ba9415c203a13d2b338e

          SHA256

          1025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e

          SHA512

          aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518

        • \Users\Admin\AppData\Local\Temp\inl9CFE.tmp

          Filesize

          122.8MB

          MD5

          446abdc1be7e417c8d994757c13b97aa

          SHA1

          231239deb2a22e8ecc98ba9415c203a13d2b338e

          SHA256

          1025f91c2dede7d12d152628c2d6f09fe09fea349f899655f308f07c32cf156e

          SHA512

          aa2e4c9ab2ab79bf04dfaecb610fba4877f5104a2ec230cfd413e5a7219a78ab8c470f2ca0ee732041f6f3a4cae63de98425ef59c4752345a09c5af782143518

        • memory/1324-92-0x0000000000BE0000-0x0000000000C07000-memory.dmp

          Filesize

          156KB

        • memory/1324-61-0x0000000002E90000-0x0000000002E9F000-memory.dmp

          Filesize

          60KB

        • memory/1324-56-0x0000000000020000-0x0000000000023000-memory.dmp

          Filesize

          12KB

        • memory/1324-55-0x0000000000BE0000-0x0000000000C07000-memory.dmp

          Filesize

          156KB

        • memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

          Filesize

          8KB