Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 16:03

General

  • Target

    589bc94cdc57903318d61d2f63fe9b90fa448af2f2fce71dc352fb8ef12916a9.exe

  • Size

    74KB

  • MD5

    90f1387a390e2cc443a1df898f863f90

  • SHA1

    e225943018d86801be6a62483b7c55d33ef0428d

  • SHA256

    589bc94cdc57903318d61d2f63fe9b90fa448af2f2fce71dc352fb8ef12916a9

  • SHA512

    f898a756da01379718c635cf3333344bdf3beeb7bb370eea6f7583bf08dfdaaf33f59a9e9f7e1b6f7bce8e7017124774c84a12a19ab1edd7be945a741d38be46

  • SSDEEP

    1536:cpeGYbmuaka3H0/sVJsyBgiXYuieehkp2KdNlpQquU+u:1bmSaasrjBT0Kcbu

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 2 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\589bc94cdc57903318d61d2f63fe9b90fa448af2f2fce71dc352fb8ef12916a9.exe
    "C:\Users\Admin\AppData\Local\Temp\589bc94cdc57903318d61d2f63fe9b90fa448af2f2fce71dc352fb8ef12916a9.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Program Files\FreeRapid\loader.tmp
      "C:\Program Files\FreeRapid\loader.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
        3⤵
          PID:3236
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\apeflacmp3.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\PROGRA~1\FREERA~1\1.bat
          3⤵
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:4288
          • C:\PROGRA~1\INTERN~1\iexplore.exe
            C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?82133
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4128
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4128 CREDAT:17410 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4268
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\PROGRA~1\FREERA~1\1.inf
            4⤵
              PID:4612
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\PROGRA~1\FREERA~1\2.bat
              4⤵
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:448
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
                5⤵
                • Modifies Internet Explorer settings
                • Modifies Internet Explorer start page
                PID:3168
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
                5⤵
                • Modifies Internet Explorer settings
                • Modifies Internet Explorer start page
                PID:3564
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
                5⤵
                  PID:4192
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                  5⤵
                  • Modifies registry class
                  PID:424
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\PROGRA~1\FREERA~1\3.bat""" /f
                  5⤵
                  • Modifies registry class
                  PID:2816
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +h C:\PROGRA~1\FREERA~1\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                  5⤵
                  • Sets file to hidden
                  • Drops file in Program Files directory
                  • Views/modifies file attributes
                  PID:4836
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +h C:\PROGRA~1\FREERA~1\tmp
                  5⤵
                  • Sets file to hidden
                  • Drops file in Program Files directory
                  • Views/modifies file attributes
                  PID:1580
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\PROGRA~1\FREERA~1\2.inf
                  5⤵
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:5016
                  • C:\Windows\SysWOW64\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    6⤵
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4904
                    • C:\Windows\SysWOW64\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      7⤵
                        PID:5036
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32 C:\Progra~1\FreeRapid\1.bin,MainLoad
                    5⤵
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    PID:4908
            • C:\Users\Admin\AppData\Local\Temp\inl7BF8.tmp
              C:\Users\Admin\AppData\Local\Temp\inl7BF8.tmp
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1824
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl7BF8.tmp > nul
                3⤵
                  PID:4004
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\589BC9~1.EXE > nul
                2⤵
                  PID:3636

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\PROGRA~1\FREERA~1\1.bat

                Filesize

                3KB

                MD5

                b7c5e3b416b1d1b5541ef44662e1a764

                SHA1

                8bff7ea2be2f3cf29f2381d8007198b5991ca3ae

                SHA256

                f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1

                SHA512

                65dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc

              • C:\PROGRA~1\FREERA~1\1.inf

                Filesize

                492B

                MD5

                34c14b8530e1094e792527f7a474fe77

                SHA1

                f71c4e9091140256b34c18220d1dd1efab1f301d

                SHA256

                fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

                SHA512

                25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

              • C:\PROGRA~1\FREERA~1\2.bat

                Filesize

                3KB

                MD5

                d6ad3ea7acbeea6fad7d1991f40e2f97

                SHA1

                1a165c03f5c95792c9a95fcf5b19c3a439fd36ea

                SHA256

                e21abd16063ea41e1983a5be729daa6b733ca4ad0110654c1aaba1e93568febc

                SHA512

                e94850301a0efcdbd2d1a73f26c86c65c5854ef32a336d8be01edf5e97a3d7dc98ed35e11677c25e90cd7d21a1c49cfe8db9cebd526070c8b970eb450f91d7e0

              • C:\PROGRA~1\FREERA~1\2.inf

                Filesize

                230B

                MD5

                f6dcb2862f6e7f9e69fb7d18668c59f1

                SHA1

                bb23dbba95d8af94ecc36a7d2dd4888af2856737

                SHA256

                c68fe97c64b68f00b3cc853ae6a6d324b470a558df57eac2593487978592eb2c

                SHA512

                eefe630b776d2144df39e9c385824374b3d546e30293d7efe10cc2d6bf6f2c932162bf80add1c8ca58afcc868ad02b3ffc104c0f111f3827f4385ee9f26f5e75

              • C:\PROGRA~1\FREERA~1\4.bat

                Filesize

                5.8MB

                MD5

                c03e90625e0439d036678d7fbaf9b39b

                SHA1

                5ea8a08654f23db3269332e21bd60ada112ec1d6

                SHA256

                f3a2e233b3da1bbaca298c3857ba84e0ba6a1c1708c98711ac5679cc857cdbe6

                SHA512

                b0c6e1dffd4c460d91eacf4671842be921fc0128d7d591e80ec9dc983dcaa9da0d0670cd5b41c354ccf06b00cc5bcc4eea2dfab4671fa826f52d9497cf55ee1a

              • C:\Program Files\FreeRapid\1.bin

                Filesize

                57.2MB

                MD5

                082d58fbd7d9f203fa2de38b1209cc29

                SHA1

                9629ee284d4f77b3989b167b8ee71a634597e81c

                SHA256

                493a2774c2d22d072f59718b78cd5bdb50e7204eb9b52896a39ab661a66c1078

                SHA512

                f8cceeb9d1133338015ad07cd90ace2505787a76e1f9e811b8de22e1b952b92ad48bc11506d87c71886a310b9b380dbbe6e11b5777b5c9a55d19a4681fb3ff22

              • C:\Program Files\FreeRapid\loader.tmp

                Filesize

                57.3MB

                MD5

                ef15785ec1fed06385d41051bc1a3941

                SHA1

                2d2d378954b876dac5f69c94959122f83ef8c794

                SHA256

                0fea2a43223bf9ace8023a6c9290a8f99afd73fa0bfea41aeb49d3f7f3190dca

                SHA512

                adbed32bb4bb8881d995a222561661438b92783aecba93526c63a11eb7a847255a0638e8e7877613f34e3816cdc5030648bbddadf5694af70703f6a70775dcb5

              • C:\Program Files\FreeRapid\loader.tmp

                Filesize

                57.3MB

                MD5

                ef15785ec1fed06385d41051bc1a3941

                SHA1

                2d2d378954b876dac5f69c94959122f83ef8c794

                SHA256

                0fea2a43223bf9ace8023a6c9290a8f99afd73fa0bfea41aeb49d3f7f3190dca

                SHA512

                adbed32bb4bb8881d995a222561661438b92783aecba93526c63a11eb7a847255a0638e8e7877613f34e3816cdc5030648bbddadf5694af70703f6a70775dcb5

              • C:\Progra~1\FreeRapid\1.bin

                Filesize

                57.2MB

                MD5

                082d58fbd7d9f203fa2de38b1209cc29

                SHA1

                9629ee284d4f77b3989b167b8ee71a634597e81c

                SHA256

                493a2774c2d22d072f59718b78cd5bdb50e7204eb9b52896a39ab661a66c1078

                SHA512

                f8cceeb9d1133338015ad07cd90ace2505787a76e1f9e811b8de22e1b952b92ad48bc11506d87c71886a310b9b380dbbe6e11b5777b5c9a55d19a4681fb3ff22

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

                Filesize

                1KB

                MD5

                d56c49b2f0a63bdf2035a1cf5f965125

                SHA1

                70064ed9db0812ef8407d05256aa4ebf578c1597

                SHA256

                72bec14de3a4791e4d5261b80aa4062e170c117ad164e8c5a72edbe471ebc32f

                SHA512

                fa9def6b54a8fd7c74f58ebffb97e40431a14c0daed8d0edf890a25cac799bf3ac61f4a0259d95ea22e3ceb27d1862a5881d3a33ccfb9b196d1565d67efa7b2a

              • C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

                Filesize

                2KB

                MD5

                be9c2a6c4473d5ff3130700864019244

                SHA1

                bd964f122e7715e3fce78dcbbc2118cc85f42053

                SHA256

                8f07137e93b92f7942caa3cca96b3c66d390aa8aaf9bc112d3b132948c61c5bd

                SHA512

                b4810796fad38757315c6d21b03f7cc13777fc928d32f0222208f460f7a515d626837d460dbcd2c0959f1ba383f60a395724325cd7a8d0b8c53538a0a4b16cbc

              • C:\Users\Admin\AppData\Local\Temp\apeflacmp3.bat

                Filesize

                36B

                MD5

                0b53221b1332efb76ebd2ab7120ff78f

                SHA1

                e3dda4d21e35819eaf50e50c2aab2950ff1505b5

                SHA256

                05bbda79058985c35a48637dcbc66c73176e1f7e4c95e8aef8b762066b780388

                SHA512

                877637688f255d94b94feb3b2444678836db41644f6e1a7d1f902c8c12bab45785393a8f210215eebcdcb3526002632863bf54f026047aa1edee8481b26dddcd

              • C:\Users\Admin\AppData\Local\Temp\inl7BF8.tmp

                Filesize

                57.2MB

                MD5

                107331e5e7512147e9d2464a66bf603d

                SHA1

                a1dee9c148f8b38edf2ba4794df1935c1d2a139b

                SHA256

                f1bf309e88e983b19833e779450aac3dff5eeaebf77b5f6aacb91e2fb1c01215

                SHA512

                e2488410871e16beaeb7ab35b1d74f06e6b0f6919bd47e7823e84e5958bfe0999b4cfff624b89d22f24a4d9fe9513c65fab57c6537289811ea4642b67f015032

              • C:\Users\Admin\AppData\Local\Temp\inl7BF8.tmp

                Filesize

                57.2MB

                MD5

                107331e5e7512147e9d2464a66bf603d

                SHA1

                a1dee9c148f8b38edf2ba4794df1935c1d2a139b

                SHA256

                f1bf309e88e983b19833e779450aac3dff5eeaebf77b5f6aacb91e2fb1c01215

                SHA512

                e2488410871e16beaeb7ab35b1d74f06e6b0f6919bd47e7823e84e5958bfe0999b4cfff624b89d22f24a4d9fe9513c65fab57c6537289811ea4642b67f015032

              • C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

                Filesize

                631B

                MD5

                0b92bb1f3b9141d221dfedfcc5a59527

                SHA1

                8d0a11d39776442b53436490284dc460137d3e7a

                SHA256

                5ad1f9cc4cff9a7d07bf72edc9ce2ccb0e75a6bb8038ab92a27a54914d560a99

                SHA512

                e3472c917c7ac2657f4ceb3bf8d1cdabca72bc0090ce2d33b3c334d86ad4cb8b68e109d936f6d99b38dd8d44bcd2e2e152d3292c10c77461e79bb13b2db04205

              • memory/1824-170-0x00000000008A0000-0x00000000008A9000-memory.dmp

                Filesize

                36KB

              • memory/4128-181-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-193-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-161-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-163-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-164-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-166-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-168-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-160-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-155-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-171-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-169-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-152-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-174-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-232-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-176-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-178-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-231-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-180-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-183-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-151-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-184-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-150-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-186-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-149-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-188-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-226-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-148-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-145-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-192-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-158-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-225-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-195-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-223-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-200-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-201-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-144-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-203-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-222-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-221-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-220-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-219-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-210-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-218-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4128-212-0x00007FFD33E70000-0x00007FFD33EDE000-memory.dmp

                Filesize

                440KB

              • memory/4908-211-0x0000000073BA0000-0x0000000073BAA000-memory.dmp

                Filesize

                40KB

              • memory/4996-132-0x0000000000C20000-0x0000000000C5C000-memory.dmp

                Filesize

                240KB

              • memory/4996-173-0x0000000000C20000-0x0000000000C5C000-memory.dmp

                Filesize

                240KB

              • memory/4996-133-0x0000000000DE0000-0x0000000000DE3000-memory.dmp

                Filesize

                12KB