Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 16:21

General

  • Target

    1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe

  • Size

    140KB

  • MD5

    11021db97d90d9c17d0d1356c0264b42

  • SHA1

    641a551bba6e456655d67bacd3e5e10f3d508a3b

  • SHA256

    1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109

  • SHA512

    27a0db8995dfe4e6df316773b2a0dc450f25b57a16c4d6c1aae5235ee83b9be430a9d03a66149814f8a54f6fb85d4e90aa782c1a90f698fa73b8478a63f8c38c

  • SSDEEP

    1536:nnMg2OVLjlevyaRLBnLuRgiaUxRIxecePKH5nKLV+Y:M0LpeTLlamiaUxRIxecePKQN

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe
    "C:\Users\Admin\AppData\Local\Temp\1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:724
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1428
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1520
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf
          4⤵
            PID:3096
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat
            4⤵
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:4560
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:824
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
              5⤵
                PID:3588
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:3756
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:4356
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:4808
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1748
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf
                5⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:3520
                • C:\Windows\SysWOW64\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:4220
                  • C:\Windows\SysWOW64\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    7⤵
                      PID:3628
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 D:\VolumeDH\inj.dat,MainLoad
                  5⤵
                    PID:2016
            • C:\Users\Admin\AppData\Local\Temp\inl176D.tmp
              C:\Users\Admin\AppData\Local\Temp\inl176D.tmp
              2⤵
              • Executes dropped EXE
              PID:4668
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1259F3~1.EXE > nul
              2⤵
                PID:2872

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              9ebd067ed9097e52468ed43389e20f84

              SHA1

              254e9e98e444f9aa5025e9f39d26c2ee6343b070

              SHA256

              c2f13a89d711a444d9e2e5a909191abfd3b00b1c73d8b6b5d8f9df8eaa5f8bad

              SHA512

              a70df9fc2fb4ffd351c4702d5b7dfda2f5b96b3596d53f09f981afce933a53768c940dc04e93b0098f5d2a309919d6b3a4398bb03b8bc5aa67c4ac7dff525c3f

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              434B

              MD5

              a00b0c5cc4186ffd1a905146175781d5

              SHA1

              fd4abed3c389efd2cc548ec60745a2fa1b94393a

              SHA256

              96ece9b1fb9cfd87e2cd17390f68d949f8c719aada8f086e1580fd5a5f9033b9

              SHA512

              d2a85066d7bfddcd113e93d591d83961a0ab25e7052d8d6c3681c8ff35db2050572a88350e7ea130fa8eae217ad746eac860703cbed01cbf92527310b6c46dc1

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

              Filesize

              1KB

              MD5

              a6e42178661208af0ac65b5c1799df9f

              SHA1

              1e3b5e7773d2bbf12f985c991155fbbf6ab4a1ee

              SHA256

              4c2817bb748fc34d77c2335c3d8e3d8b86a464735a65597bf74f63d84b91e387

              SHA512

              b1a0c94dbe697bc32af4bf6b8993a9e69b5268e11e27bc811bb5abecebf0cb6b41137ad60f5c692dd97a6f648fdcb784d753de90b9cd0e3d49262c3dfce8d1e8

            • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

              Filesize

              1KB

              MD5

              3facc60dceffd752f284e286f4ceeb8a

              SHA1

              667ffb98ff425eeb8e3c4c85e0b9fee75cf76da4

              SHA256

              a0583d0e827c3e2aabdfb4e99d6ce78e06eac265bd85f339559433571853f56d

              SHA512

              26c16fd7d173aca60695d464035f639affbb0dcc74788b9246fa051a2bdcfa886e162014ff0eca751fcb90c84a17ab77bacfda1442249f4cbe6bb334c06ce317

            • C:\Users\Admin\AppData\Local\Temp\inl176D.tmp

              Filesize

              57.2MB

              MD5

              82afc4b59b2f39e8104a7c90e7b70d36

              SHA1

              521e773c21ccfcb30df0d328e031f0b1feb2178b

              SHA256

              2d42ea46ac2d10e47ae7a2f68e3e37498dbc2837165765588b921aef74464ec4

              SHA512

              58468eaf102e029fa7e91d1cb781dda5a4491a8a54345d9203b4bf2700f72e62389f61311190f7f8cd6dffc2d74d18ee86dd7f2e74791956c47096d433edd7e1

            • C:\Users\Admin\AppData\Local\Temp\inl176D.tmp

              Filesize

              57.2MB

              MD5

              82afc4b59b2f39e8104a7c90e7b70d36

              SHA1

              521e773c21ccfcb30df0d328e031f0b1feb2178b

              SHA256

              2d42ea46ac2d10e47ae7a2f68e3e37498dbc2837165765588b921aef74464ec4

              SHA512

              58468eaf102e029fa7e91d1cb781dda5a4491a8a54345d9203b4bf2700f72e62389f61311190f7f8cd6dffc2d74d18ee86dd7f2e74791956c47096d433edd7e1

            • C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat

              Filesize

              53B

              MD5

              9b41ad553fc0a87c014049dfede9e7fa

              SHA1

              840b9c356ec59e65d33bae61c439b0abf11663bd

              SHA256

              a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e

              SHA512

              6de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8

            • C:\Users\Admin\AppData\Roaming\winzip\1.bat

              Filesize

              2KB

              MD5

              68a30985a8b4a1dae5b24721ca5b8269

              SHA1

              78481107bbddcf18ffc4d25a184ec74274241a6b

              SHA256

              fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf

              SHA512

              d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24

            • C:\Users\Admin\AppData\Roaming\winzip\1.inf

              Filesize

              410B

              MD5

              66a1f0147fed7ddd19e9bb7ff93705c5

              SHA1

              9d803c81ea2195617379b880b227892ba30b0bf6

              SHA256

              4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

              SHA512

              cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

            • C:\Users\Admin\AppData\Roaming\winzip\2.bat

              Filesize

              3KB

              MD5

              c106ffc420b54a4f0fd331f10657dc66

              SHA1

              8930d5b56358f518bdf5ccca2b4d24f98ce7a03f

              SHA256

              fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b

              SHA512

              ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd

            • C:\Users\Admin\AppData\Roaming\winzip\2.inf

              Filesize

              247B

              MD5

              bf915cb73f6126d712c727039ad3d5e6

              SHA1

              73ff72a83711c90e45f8bd34505b3284fd2a870b

              SHA256

              3fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940

              SHA512

              752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957

            • C:\Users\Admin\AppData\Roaming\winzip\4.bat

              Filesize

              44KB

              MD5

              8522ac3efdf1fac2a56fa3b193e05926

              SHA1

              bcf84a073dcc79da722402704a3db1343606c236

              SHA256

              420d8cd6599fd841d42ed72338c35836195748e51e4671e20a3c2a2edb6dc708

              SHA512

              06125a21c80e87bf778708b1f09eb066fa85f8fb2251458205d719cefece7e30e520dcc7ab0d17abb6547db8e8c4fda3f3465604bd393ef94a1ab7f38b67d3dd

            • memory/1428-172-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-185-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-150-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-151-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-152-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-154-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-138-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-146-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-145-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-161-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-144-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-155-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-163-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-143-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-165-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-166-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-167-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-220-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-169-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-142-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-219-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-214-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-213-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-211-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-178-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-179-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-180-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-210-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-182-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-183-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-209-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-147-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-186-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-208-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-189-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-139-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-207-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-206-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-201-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-196-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-197-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-198-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/1428-200-0x00007FFB89E00000-0x00007FFB89E6E000-memory.dmp

              Filesize

              440KB

            • memory/4964-132-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB

            • memory/4964-226-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB