Overview

overview

10

Static

static

aacf3d4a52...c7.exe

windows7-x64

10

aacf3d4a52...c7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21-10-2022 06:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe

  • Size

    678KB

  • MD5

    459a7c65a7356c462d338762a9a9a310

  • SHA1

    50d6a90197394e589ced3008fe2c65abc13635b2

  • SHA256

    aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7

  • SHA512

    2c4054de1a040c4cb3150880e1804870973bf0e6edcecb3ef513ab76dbf69cf6051dabe67b4811f4ee91a9059170e69c8245f67cacc1d0f1ea3eae089109e82e

  • SSDEEP

    12288:0eOtTM7xyL7Irnc9UtTsDvMLafJCqRLQn3PRvX+PghHMpH6KR5M:MtTsxSMX8MOfJCqJW/IEsI

Score
10/10
jokerinfostealertrojanupx

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Executes dropped EXE 4 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 21 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe
        "C:\Users\Admin\AppData\Local\Temp\aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
          "C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Users\Admin\AppData\Local\Temp\8.exe
            "C:\Users\Admin\AppData\Local\Temp\8.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:912
          • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
            "C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe"
            4⤵
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1452
        • C:\Users\Admin\AppData\Local\Temp\Temp\e.exe
          "C:\Users\Admin\AppData\Local\Temp\Temp\e.exe"
          3⤵
          • Executes dropped EXE
          PID:784

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\8.exe
      Filesize

      25KB

      MD5

      92f20eaf50a3466ecbaff86e46cd8f9a

      SHA1

      40b92ef5175b5ce3692ab7a54c489fefa94c6cd8

      SHA256

      2f85810c047c2c9bd5745c2fbc30f82c345d82dd8a9ab2ce523ebd077632b6d6

      SHA512

      d0c8a4ae86a6d98ed8c98a0c7bdf530c7460d891c079029b1036c74bae740c706d2df74e49b0ca93f58e6e8aecea39c591a75569458dd4378b9931726872ad65

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      502KB

      MD5

      18d4d2865ad668f38528c3be82a424ab

      SHA1

      ad2d4e3a229b55733b741705628e6d604844ddb1

      SHA256

      dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

      SHA512

      9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      502KB

      MD5

      18d4d2865ad668f38528c3be82a424ab

      SHA1

      ad2d4e3a229b55733b741705628e6d604844ddb1

      SHA256

      dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

      SHA512

      9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      577KB

      MD5

      090f211113248f827acf9081fce995cd

      SHA1

      783d02d630947b4daac3a487464022604f0eac7e

      SHA256

      3fee75e83c51f7e61b5add690ef73329fda7cf25be5448b723ca6a0160ce7741

      SHA512

      8db45b622c8a39dbbb0c8560f97a3639c40bdeab615e40338f076134c4b206de531aede3c571a25b0e70fc314eb47284e14ad1b126ed2e781393bb82c71af8a1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Temp\e.exe
      Filesize

      82KB

      MD5

      a637735cc3beb5182fa61b66581a5d41

      SHA1

      cdc26d8a8342f9d8395b0d82e58492399cdcd3da

      SHA256

      b447be14730611eb664b4971503985b25edf8ed9d84ae6eb1118bec2388a8793

      SHA512

      b327eac50e68930cf18d907878ee0a949cb6fa7caa4f535d00be79954418ec97457fdfe82977ea4a7e35beef58afb4f01e10de9490e3ad030bad5c3fc96c1037

      Download Submit

    • \Users\Admin\AppData\Local\Temp\8.exe
      Filesize

      25KB

      MD5

      92f20eaf50a3466ecbaff86e46cd8f9a

      SHA1

      40b92ef5175b5ce3692ab7a54c489fefa94c6cd8

      SHA256

      2f85810c047c2c9bd5745c2fbc30f82c345d82dd8a9ab2ce523ebd077632b6d6

      SHA512

      d0c8a4ae86a6d98ed8c98a0c7bdf530c7460d891c079029b1036c74bae740c706d2df74e49b0ca93f58e6e8aecea39c591a75569458dd4378b9931726872ad65

      Download Submit

    • \Users\Admin\AppData\Local\Temp\8.exe
      Filesize

      25KB

      MD5

      92f20eaf50a3466ecbaff86e46cd8f9a

      SHA1

      40b92ef5175b5ce3692ab7a54c489fefa94c6cd8

      SHA256

      2f85810c047c2c9bd5745c2fbc30f82c345d82dd8a9ab2ce523ebd077632b6d6

      SHA512

      d0c8a4ae86a6d98ed8c98a0c7bdf530c7460d891c079029b1036c74bae740c706d2df74e49b0ca93f58e6e8aecea39c591a75569458dd4378b9931726872ad65

      Download Submit

    • \Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      502KB

      MD5

      18d4d2865ad668f38528c3be82a424ab

      SHA1

      ad2d4e3a229b55733b741705628e6d604844ddb1

      SHA256

      dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

      SHA512

      9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      502KB

      MD5

      18d4d2865ad668f38528c3be82a424ab

      SHA1

      ad2d4e3a229b55733b741705628e6d604844ddb1

      SHA256

      dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

      SHA512

      9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      577KB

      MD5

      090f211113248f827acf9081fce995cd

      SHA1

      783d02d630947b4daac3a487464022604f0eac7e

      SHA256

      3fee75e83c51f7e61b5add690ef73329fda7cf25be5448b723ca6a0160ce7741

      SHA512

      8db45b622c8a39dbbb0c8560f97a3639c40bdeab615e40338f076134c4b206de531aede3c571a25b0e70fc314eb47284e14ad1b126ed2e781393bb82c71af8a1

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
      Filesize

      577KB

      MD5

      090f211113248f827acf9081fce995cd

      SHA1

      783d02d630947b4daac3a487464022604f0eac7e

      SHA256

      3fee75e83c51f7e61b5add690ef73329fda7cf25be5448b723ca6a0160ce7741

      SHA512

      8db45b622c8a39dbbb0c8560f97a3639c40bdeab615e40338f076134c4b206de531aede3c571a25b0e70fc314eb47284e14ad1b126ed2e781393bb82c71af8a1

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Temp\e.exe
      Filesize

      82KB

      MD5

      a637735cc3beb5182fa61b66581a5d41

      SHA1

      cdc26d8a8342f9d8395b0d82e58492399cdcd3da

      SHA256

      b447be14730611eb664b4971503985b25edf8ed9d84ae6eb1118bec2388a8793

      SHA512

      b327eac50e68930cf18d907878ee0a949cb6fa7caa4f535d00be79954418ec97457fdfe82977ea4a7e35beef58afb4f01e10de9490e3ad030bad5c3fc96c1037

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Temp\e.exe
      Filesize

      82KB

      MD5

      a637735cc3beb5182fa61b66581a5d41

      SHA1

      cdc26d8a8342f9d8395b0d82e58492399cdcd3da

      SHA256

      b447be14730611eb664b4971503985b25edf8ed9d84ae6eb1118bec2388a8793

      SHA512

      b327eac50e68930cf18d907878ee0a949cb6fa7caa4f535d00be79954418ec97457fdfe82977ea4a7e35beef58afb4f01e10de9490e3ad030bad5c3fc96c1037

      Download Submit

    • memory/584-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

      Filesize

      8KB

      Download

    • memory/784-67-0x0000000000400000-0x00000000004199A2-memory.dmp

      Filesize

      102KB

      Download

    • memory/912-74-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

      Download

    • memory/1452-81-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-106-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-76-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-79-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-78-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-126-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-82-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-96-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-94-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-92-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-90-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-88-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-86-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-84-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-125-0x0000000000400000-0x00000000005BE000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/1452-114-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-116-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-122-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-120-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-118-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-112-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-110-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-108-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-104-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-102-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-100-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-98-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-124-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/1452-123-0x0000000000400000-0x00000000005BE000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/1724-73-0x0000000000400000-0x0000000000491D08-memory.dmp

      Filesize

      583KB

      Download