joker | 240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
Size

1.2MB
MD5

7b159c899ab5c3fdeb2a0a0aebfe280b
SHA1

b80f784e5e7b0f8d44e63a01f0221b429fc5afdc
SHA256

240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827
SHA512

659c3c3d2859086bd901978f7ab8381eff312f161c41634b07b0c80fde395920a7142a81e26756c927f70bfd5d6cf4c7ae6df0e2bb7e297a7dc5206fefa3dba9
SSDEEP

12288:/z7PzGXyhTE3xn8QLHxqr7pCDRFLP7uNrGuXyA9GSEXFBckIR:/z7bGXyh6xntLRqvpCTLP7s7RQlcNR

Score

10^/10

joker infostealer trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\safe.ico	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp	expand.exe
File opened for modification	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\job.xml	expand.exe
File opened for modification	C:\progra~1\ico\meiv.ico	expand.exe
File opened for modification	C:\progra~1\ico\{FA5D5E4C-18F8-4F8A-8F13-3D00F611C6F1}	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\e2ac1e78418d214587a287d015f4ca84.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Beauty.ico	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\b616ad30371d39489db63b899f4039d0.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Taobao.ico	expand.exe
File opened for modification	C:\progra~1\ico\Chat.ico	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\27f3b1ea6c05204cafac1a4f5f05e569.tmp	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\5b3e84b284068347b6b715bc97ee7110.tmp	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\84a7fab91281144694521f826a4363cc.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Film.ico	expand.exe
File created	C:\progra~1\ico\1a605394d5c643789776199b46ed7d11$dpx$.tmp\f377496d8011ec49976188b48f0833f4.tmp	expand.exe
File opened for modification	C:\progra~1\ico\Video.ico	expand.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08c7dabbbdfd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mitao01.bar\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000007027affa327bb790526453012eb55caa85cf1eb345bc275dd05eb7c59f9fda0000000000e8000000002000020000000a5172ae3f60930418c2ea549d604c1bc6ff25371bf65e6e923bb20c1dfef8a18200000006ffce1005c0bd5325376815adc33345b1263954552c76002b47f3e8cb83be24640000000630bd50160d8a3e05e22cdc89318f59c9eb7d34aa687444cf45942d02f58d1fe6f65cb5856c35740e410da0b68cfa752224e5a767f2f92edbe41220416080027	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2412949312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B797A12A-4BAE-11ED-B696-D2371B4A40BE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2516069108"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2532759021"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7953E88-4BAE-11ED-B696-D2371B4A40BE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2416543262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2522349045"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\779dh.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.779dh.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990267"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990267"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372509928"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7956598-4BAE-11ED-B696-D2371B4A40BE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2424043325"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
4728	msedge.exe
4728	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
436	iexplore.exe
632	iexplore.exe
4356	iexplore.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
436	iexplore.exe
436	iexplore.exe
632	iexplore.exe
632	iexplore.exe
4356	iexplore.exe
4356	iexplore.exe
3360	IEXPLORE.EXE
3360	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
672	IEXPLORE.EXE
672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3736	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	83
PID 4116 wrote to memory of 3736	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	83
PID 4116 wrote to memory of 3736	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	83
PID 4116 wrote to memory of 1080	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	82
PID 4116 wrote to memory of 1080	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	82
PID 4116 wrote to memory of 1080	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	82
PID 3736 wrote to memory of 4948	3736	cmd.exe	85
PID 3736 wrote to memory of 4948	3736	cmd.exe	85
PID 3736 wrote to memory of 4948	3736	cmd.exe	85
PID 4116 wrote to memory of 436	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	88
PID 4116 wrote to memory of 436	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	88
PID 4116 wrote to memory of 4356	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	89
PID 4116 wrote to memory of 4356	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	89
PID 4116 wrote to memory of 632	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	90
PID 4116 wrote to memory of 632	4116	240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe	90
PID 1092 wrote to memory of 3732	1092	explorer.exe	91
PID 1092 wrote to memory of 3732	1092	explorer.exe	91
PID 3732 wrote to memory of 1536	3732	msedge.exe	93
PID 3732 wrote to memory of 1536	3732	msedge.exe	93
PID 4356 wrote to memory of 1620	4356	iexplore.exe	95
PID 4356 wrote to memory of 1620	4356	iexplore.exe	95
PID 4356 wrote to memory of 1620	4356	iexplore.exe	95
PID 632 wrote to memory of 3360	632	iexplore.exe	94
PID 632 wrote to memory of 3360	632	iexplore.exe	94
PID 632 wrote to memory of 3360	632	iexplore.exe	94
PID 436 wrote to memory of 672	436	iexplore.exe	96
PID 436 wrote to memory of 672	436	iexplore.exe	96
PID 436 wrote to memory of 672	436	iexplore.exe	96
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99
PID 3732 wrote to memory of 4792	3732	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe
"C:\Users\Admin\AppData\Local\Temp\240b8caa66100e6055321b904b19fe9eb7ff2d9dc84732f886d0a8ce06e25827.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.v258.net/list/list16.html?mmm
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\BokPe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:4948
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.q22.cc/?ukt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:436 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.v921.com/?uk
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4356 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.779dh.com/?kj
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:632 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.v258.net/list/list16.html?mmm
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffe360246f8,0x7ffe36024708,0x7ffe36024718
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6717595513478775085,5906233250542184361,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
    3⤵
    PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
b90f7774c9a454dcb4e765a13fd24eb0

SHA1
f08a1453647c33dfd7d5757619f8b786106c1810

SHA256
cef9e0d09bcefec36de16ecca1a53665018bae69aac8c5350e5e74594574b877

SHA512
648f95283286096734187c0c130db8ee294046fde96bcaf7409761bc5b4207073b2006f4dddd8c8e3f44423934ce92ac112bd18fafc329e0b839404552b54249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
1bc8c5d2f8e5c7ad0bf3c2385ec2cdad

SHA1
d84335660cc22eed1753210bc564ca38e1fa4cd9

SHA256
e755f3edba4d4642574362c644a6c239136835f48a08bc86dd7fe07dba664e2c

SHA512
afcbef6c6563f5ebeda0912dd6d8f7d46d805bde5708a4820f8b1e3b2c1dc37f59ef083771e921c1b5984a6ff2c0769bd3df3209e08b74483c8190103676510c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
6ad22bb37c06a8542959021fc49948fa

SHA1
753e47099793b24efedc8208611e9fabb74990b2

SHA256
e88f513b287a2aaa2118d51d71a20ff6cd04dacb2bbafba25676fc0ade7874b7

SHA512
838d033789ae6028b8fac4c5a6f7415d1515a2ea3a4a022c890e0879abddcf05794165799ae890ae3c54601fed034efb3f2fed35d3fa980c13941799d87dd440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
1f56f7106b551028c801e53d9a2c0803

SHA1
796ead43364a66d35c73b41faaf26c1fdf17df98

SHA256
b135c08a78da1dcb13702f54a015dfbc4cc8a20d7c717185685fc45bee9af5ab

SHA512
1f8dcc48f1c493f6bcd692fcd52c51dd333b99455a7ca4cfeb9c04f3905c6230d6470a42abb8792aae5356a1304a8cf3d340f000590ff5d816088264c5bbedc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
180fcde12eae14944c35f89540da4ce0

SHA1
a82a0779eb87e9496da17878ebf59efc24e0ba17

SHA256
4478f444f180b9e9a48d753650afece4b4e82e20ec093c0ef399d649a0c1388b

SHA512
bb94264f86e23e4057966be8d6d5dfa3f574ece891e639019f95efdd523ff72d78ad77626085363dfd7a0626c7a0ca6db8caad8dd50965ef007ce7134dc0d369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
83c762923c947f15c6cfc71555b0a32e

SHA1
c77a13ed08f7e54ce77fe3bcd5b6a1879823af2f

SHA256
441377bcc168dae1fccf8bd4a569aff5c89391e86c3e026c5eee6b106fd75a1d

SHA512
29157a826c7bc3b24205132cf5fabcc189ef7f83ebb4b152d3b077155ce828183ea723f3d07fa2f0572563b254124e03655ea3f2882db857ffe6aa2e5ac038c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B7956598-4BAE-11ED-B696-D2371B4A40BE}.dat

Filesize
3KB

MD5
a3b4f7195715ebbc556670ae41c18b46

SHA1
03c78639ba15ff014bc422598d220bfa8307fc92

SHA256
0ab87e6c97074f040687b4f95b4d86b98424e994a2624eecfc9fdc3e5c2ff450

SHA512
d28624a3dc8e1ab411419603ab743f52dc6570408dc8897cf0bd4909e6346611721a3b1342e87b8d1305f8b4843fb210d6bba9edc0db2f1e5d71af9fa10fb2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B797A12A-4BAE-11ED-B696-D2371B4A40BE}.dat

Filesize
3KB

MD5
ddf491d6e6c96817638c0c9c31c293ec

SHA1
f0108d6e3a71314d0d9bb982d7b9aab2532cce96

SHA256
0cc4d047b9a3c4c850d72e6cd75e30a112bce9d27f0530cef0e356799d10a365

SHA512
2eabae2f86629436f8433c754c44e108f3f1918b350fe21986e73e8e96ca291b0fb5a667b8d62fbb457dc09006165b2b921741d97297a03c39c2bcffa5011da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BokPe.bat

Filesize
98B

MD5
ada787702460241a372c495dc53dbdcf

SHA1
da7d65ec9541fe9ed13b3531f38202f83b0ac96d

SHA256
0d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850

SHA512
c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708

Download Submit
\??\c:\users\admin\appdata\local\temp\ico.cab

Filesize
20KB

MD5
1319e9998cedc513c68fa6d590b6ad63

SHA1
ae95b333e88a13886994f320f5dfb4856168a710

SHA256
9a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb

SHA512
d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f

Download Submit
memory/4116-133-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download