Overview

overview

10

Static

static

aacf3d4a52...c7.exe

windows7-x64

10

aacf3d4a52...c7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-10-2022 06:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe

  • Size

    678KB

  • MD5

    459a7c65a7356c462d338762a9a9a310

  • SHA1

    50d6a90197394e589ced3008fe2c65abc13635b2

  • SHA256

    aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7

  • SHA512

    2c4054de1a040c4cb3150880e1804870973bf0e6edcecb3ef513ab76dbf69cf6051dabe67b4811f4ee91a9059170e69c8245f67cacc1d0f1ea3eae089109e82e

  • SSDEEP

    12288:0eOtTM7xyL7Irnc9UtTsDvMLafJCqRLQn3PRvX+PghHMpH6KR5M:MtTsxSMX8MOfJCqJW/IEsI

Score
10/10
jokerinfostealertrojanupx

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Executes dropped EXE 4 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:512
      • C:\Users\Admin\AppData\Local\Temp\aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe
        "C:\Users\Admin\AppData\Local\Temp\aacf3d4a52d20f71a8f5a78505145d24fe378b23aa2008fb0197557ca28a1ac7.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Users\Admin\AppData\Local\Temp\Temp\e.exe
          "C:\Users\Admin\AppData\Local\Temp\Temp\e.exe"
          3⤵
          • Executes dropped EXE
          PID:2912
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 216
            4⤵
            • Program crash
            PID:4648
        • C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
          "C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2912 -ip 2912
      1⤵
        PID:4708
      • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
        "C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe"
        1⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:876
      • C:\Users\Admin\AppData\Local\Temp\8.exe
        "C:\Users\Admin\AppData\Local\Temp\8.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4760

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\8.exe
        Filesize

        25KB

        MD5

        92f20eaf50a3466ecbaff86e46cd8f9a

        SHA1

        40b92ef5175b5ce3692ab7a54c489fefa94c6cd8

        SHA256

        2f85810c047c2c9bd5745c2fbc30f82c345d82dd8a9ab2ce523ebd077632b6d6

        SHA512

        d0c8a4ae86a6d98ed8c98a0c7bdf530c7460d891c079029b1036c74bae740c706d2df74e49b0ca93f58e6e8aecea39c591a75569458dd4378b9931726872ad65

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\8.exe
        Filesize

        25KB

        MD5

        92f20eaf50a3466ecbaff86e46cd8f9a

        SHA1

        40b92ef5175b5ce3692ab7a54c489fefa94c6cd8

        SHA256

        2f85810c047c2c9bd5745c2fbc30f82c345d82dd8a9ab2ce523ebd077632b6d6

        SHA512

        d0c8a4ae86a6d98ed8c98a0c7bdf530c7460d891c079029b1036c74bae740c706d2df74e49b0ca93f58e6e8aecea39c591a75569458dd4378b9931726872ad65

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
        Filesize

        502KB

        MD5

        18d4d2865ad668f38528c3be82a424ab

        SHA1

        ad2d4e3a229b55733b741705628e6d604844ddb1

        SHA256

        dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

        SHA512

        9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
        Filesize

        502KB

        MD5

        18d4d2865ad668f38528c3be82a424ab

        SHA1

        ad2d4e3a229b55733b741705628e6d604844ddb1

        SHA256

        dcfffee28b09fb92272442a7206f3f5d87ba0c8da4df1be3950b7172cb6e7232

        SHA512

        9a21247118dcc2f79272fa6056cf175e287ba8312e75dfd326601f36c0f7991110a6e11b47acbea69e61576577bbb5b320bb2e39faf6fc9a9c3b251806c6e86a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
        Filesize

        577KB

        MD5

        090f211113248f827acf9081fce995cd

        SHA1

        783d02d630947b4daac3a487464022604f0eac7e

        SHA256

        3fee75e83c51f7e61b5add690ef73329fda7cf25be5448b723ca6a0160ce7741

        SHA512

        8db45b622c8a39dbbb0c8560f97a3639c40bdeab615e40338f076134c4b206de531aede3c571a25b0e70fc314eb47284e14ad1b126ed2e781393bb82c71af8a1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Temp\CFÌìÉñ¸¨Öú¹¤¾ß0327°æSP1.exe
        Filesize

        577KB

        MD5

        090f211113248f827acf9081fce995cd

        SHA1

        783d02d630947b4daac3a487464022604f0eac7e

        SHA256

        3fee75e83c51f7e61b5add690ef73329fda7cf25be5448b723ca6a0160ce7741

        SHA512

        8db45b622c8a39dbbb0c8560f97a3639c40bdeab615e40338f076134c4b206de531aede3c571a25b0e70fc314eb47284e14ad1b126ed2e781393bb82c71af8a1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Temp\e.exe
        Filesize

        82KB

        MD5

        a637735cc3beb5182fa61b66581a5d41

        SHA1

        cdc26d8a8342f9d8395b0d82e58492399cdcd3da

        SHA256

        b447be14730611eb664b4971503985b25edf8ed9d84ae6eb1118bec2388a8793

        SHA512

        b327eac50e68930cf18d907878ee0a949cb6fa7caa4f535d00be79954418ec97457fdfe82977ea4a7e35beef58afb4f01e10de9490e3ad030bad5c3fc96c1037

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Temp\e.exe
        Filesize

        82KB

        MD5

        a637735cc3beb5182fa61b66581a5d41

        SHA1

        cdc26d8a8342f9d8395b0d82e58492399cdcd3da

        SHA256

        b447be14730611eb664b4971503985b25edf8ed9d84ae6eb1118bec2388a8793

        SHA512

        b327eac50e68930cf18d907878ee0a949cb6fa7caa4f535d00be79954418ec97457fdfe82977ea4a7e35beef58afb4f01e10de9490e3ad030bad5c3fc96c1037

        Download Submit

      • memory/876-185-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-163-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-196-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-195-0x0000000000400000-0x00000000005BE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/876-194-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-173-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-147-0x0000000000400000-0x00000000005BE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/876-148-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-150-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-151-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-153-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-152-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-155-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-159-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-157-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-161-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-175-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-165-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-167-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-169-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-171-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-181-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-179-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-183-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-191-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-187-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-189-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-177-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/876-193-0x0000000010000000-0x000000001003D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2292-143-0x0000000000400000-0x0000000000491D08-memory.dmp

        Filesize

        583KB

        Download

      • memory/2912-145-0x0000000000400000-0x00000000004199A2-memory.dmp

        Filesize

        102KB

        Download

      • memory/4760-146-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download