Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe
Resource
win10v2004-20220901-en
General
-
Target
1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe
-
Size
140KB
-
MD5
11021db97d90d9c17d0d1356c0264b42
-
SHA1
641a551bba6e456655d67bacd3e5e10f3d508a3b
-
SHA256
1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109
-
SHA512
27a0db8995dfe4e6df316773b2a0dc450f25b57a16c4d6c1aae5235ee83b9be430a9d03a66149814f8a54f6fb85d4e90aa782c1a90f698fa73b8478a63f8c38c
-
SSDEEP
1536:nnMg2OVLjlevyaRLBnLuRgiaUxRIxecePKH5nKLV+Y:M0LpeTLlamiaUxRIxecePKQN
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 4668 inl176D.tmp -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4808 attrib.exe 1748 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cmd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CEB026FE-5237-11ED-A0EE-6E8F4548B5DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu1111.site IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991940" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000136bc0d42beab08be80ad8be7b510f6a0ee14ccbe04f4b5bab550777dd544e59000000000e8000000002000020000000f21aefdf8396b5fa757c3c7151798952be75b1a3ce235773acc735a9bc80842920000000abfd9034e912e0753fde3a339a9862c53c154e556eb05994833ef419759ceeff40000000a0b34dc5cd6db444ae8125f0f1e6b881ae92a25a21f903fff0ea352c228c5e96d5830e64b8dae8373721d29da663dba952030791b4bc7cdcddffa9a97cc3ccde iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu1111.site IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu1111.site\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu1111.site\Total = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2743245335" iexplore.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2743245335" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f530b144e6d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991940" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000a6066ae8400cf37c5fcf7c01aea9ac420fe681d4695ce729e7c64c48e34d4a78000000000e80000000020000200000005bf127dcdf856372f54f416ce5099c453a46249b26f66a9a18b4bd82d8854fd420000000d933058dfeb78d03128a711bbaed3b90cc37dc3bfb48d9c279c4ec139df514a7400000005ddd05dddf124f1752f442a0e1ec5e97b30c9ffbe1a173e5db632df43ebc4f466d4e479959cc7355d2f94f57049d635e45b325e3d85248223316e4fbf127fe08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu1111.site\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991940" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709d22b144e6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2765122648" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S" reg.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\3.bat\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1428 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1428 iexplore.exe 1428 iexplore.exe 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 4964 wrote to memory of 724 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 89 PID 4964 wrote to memory of 724 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 89 PID 4964 wrote to memory of 724 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 89 PID 724 wrote to memory of 3256 724 cmd.exe 91 PID 724 wrote to memory of 3256 724 cmd.exe 91 PID 724 wrote to memory of 3256 724 cmd.exe 91 PID 3256 wrote to memory of 1428 3256 cmd.exe 93 PID 3256 wrote to memory of 1428 3256 cmd.exe 93 PID 3256 wrote to memory of 3096 3256 cmd.exe 94 PID 3256 wrote to memory of 3096 3256 cmd.exe 94 PID 3256 wrote to memory of 3096 3256 cmd.exe 94 PID 3256 wrote to memory of 2192 3256 cmd.exe 95 PID 3256 wrote to memory of 2192 3256 cmd.exe 95 PID 3256 wrote to memory of 2192 3256 cmd.exe 95 PID 4964 wrote to memory of 4668 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 97 PID 4964 wrote to memory of 4668 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 97 PID 4964 wrote to memory of 4668 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 97 PID 2192 wrote to memory of 4560 2192 cmd.exe 98 PID 2192 wrote to memory of 4560 2192 cmd.exe 98 PID 2192 wrote to memory of 4560 2192 cmd.exe 98 PID 2192 wrote to memory of 824 2192 cmd.exe 99 PID 2192 wrote to memory of 824 2192 cmd.exe 99 PID 2192 wrote to memory of 824 2192 cmd.exe 99 PID 2192 wrote to memory of 3588 2192 cmd.exe 100 PID 2192 wrote to memory of 3588 2192 cmd.exe 100 PID 2192 wrote to memory of 3588 2192 cmd.exe 100 PID 1428 wrote to memory of 1520 1428 iexplore.exe 101 PID 1428 wrote to memory of 1520 1428 iexplore.exe 101 PID 1428 wrote to memory of 1520 1428 iexplore.exe 101 PID 2192 wrote to memory of 3756 2192 cmd.exe 102 PID 2192 wrote to memory of 3756 2192 cmd.exe 102 PID 2192 wrote to memory of 3756 2192 cmd.exe 102 PID 2192 wrote to memory of 4356 2192 cmd.exe 103 PID 2192 wrote to memory of 4356 2192 cmd.exe 103 PID 2192 wrote to memory of 4356 2192 cmd.exe 103 PID 2192 wrote to memory of 4808 2192 cmd.exe 104 PID 2192 wrote to memory of 4808 2192 cmd.exe 104 PID 2192 wrote to memory of 4808 2192 cmd.exe 104 PID 2192 wrote to memory of 1748 2192 cmd.exe 105 PID 2192 wrote to memory of 1748 2192 cmd.exe 105 PID 2192 wrote to memory of 1748 2192 cmd.exe 105 PID 2192 wrote to memory of 3520 2192 cmd.exe 106 PID 2192 wrote to memory of 3520 2192 cmd.exe 106 PID 2192 wrote to memory of 3520 2192 cmd.exe 106 PID 2192 wrote to memory of 2016 2192 cmd.exe 107 PID 2192 wrote to memory of 2016 2192 cmd.exe 107 PID 2192 wrote to memory of 2016 2192 cmd.exe 107 PID 3520 wrote to memory of 4220 3520 rundll32.exe 108 PID 3520 wrote to memory of 4220 3520 rundll32.exe 108 PID 3520 wrote to memory of 4220 3520 rundll32.exe 108 PID 4220 wrote to memory of 3628 4220 runonce.exe 109 PID 4220 wrote to memory of 3628 4220 runonce.exe 109 PID 4220 wrote to memory of 3628 4220 runonce.exe 109 PID 4964 wrote to memory of 2872 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 112 PID 4964 wrote to memory of 2872 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 112 PID 4964 wrote to memory of 2872 4964 1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe 112 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1748 attrib.exe 4808 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe"C:\Users\Admin\AppData\Local\Temp\1259f360e37f2afe048b928e09fb87dd47506a629736712cbf3f151dad03d109.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?821334⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf4⤵PID:3096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat4⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4560
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:824
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f5⤵PID:3588
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:3756
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f5⤵
- Modifies registry class
PID:4356
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4808
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1748
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf5⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:3628
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:2016
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inl176D.tmpC:\Users\Admin\AppData\Local\Temp\inl176D.tmp2⤵
- Executes dropped EXE
PID:4668
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1259F3~1.EXE > nul2⤵PID:2872
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD59ebd067ed9097e52468ed43389e20f84
SHA1254e9e98e444f9aa5025e9f39d26c2ee6343b070
SHA256c2f13a89d711a444d9e2e5a909191abfd3b00b1c73d8b6b5d8f9df8eaa5f8bad
SHA512a70df9fc2fb4ffd351c4702d5b7dfda2f5b96b3596d53f09f981afce933a53768c940dc04e93b0098f5d2a309919d6b3a4398bb03b8bc5aa67c4ac7dff525c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5a00b0c5cc4186ffd1a905146175781d5
SHA1fd4abed3c389efd2cc548ec60745a2fa1b94393a
SHA25696ece9b1fb9cfd87e2cd17390f68d949f8c719aada8f086e1580fd5a5f9033b9
SHA512d2a85066d7bfddcd113e93d591d83961a0ab25e7052d8d6c3681c8ff35db2050572a88350e7ea130fa8eae217ad746eac860703cbed01cbf92527310b6c46dc1
-
Filesize
1KB
MD5a6e42178661208af0ac65b5c1799df9f
SHA11e3b5e7773d2bbf12f985c991155fbbf6ab4a1ee
SHA2564c2817bb748fc34d77c2335c3d8e3d8b86a464735a65597bf74f63d84b91e387
SHA512b1a0c94dbe697bc32af4bf6b8993a9e69b5268e11e27bc811bb5abecebf0cb6b41137ad60f5c692dd97a6f648fdcb784d753de90b9cd0e3d49262c3dfce8d1e8
-
Filesize
1KB
MD53facc60dceffd752f284e286f4ceeb8a
SHA1667ffb98ff425eeb8e3c4c85e0b9fee75cf76da4
SHA256a0583d0e827c3e2aabdfb4e99d6ce78e06eac265bd85f339559433571853f56d
SHA51226c16fd7d173aca60695d464035f639affbb0dcc74788b9246fa051a2bdcfa886e162014ff0eca751fcb90c84a17ab77bacfda1442249f4cbe6bb334c06ce317
-
Filesize
57.2MB
MD582afc4b59b2f39e8104a7c90e7b70d36
SHA1521e773c21ccfcb30df0d328e031f0b1feb2178b
SHA2562d42ea46ac2d10e47ae7a2f68e3e37498dbc2837165765588b921aef74464ec4
SHA51258468eaf102e029fa7e91d1cb781dda5a4491a8a54345d9203b4bf2700f72e62389f61311190f7f8cd6dffc2d74d18ee86dd7f2e74791956c47096d433edd7e1
-
Filesize
57.2MB
MD582afc4b59b2f39e8104a7c90e7b70d36
SHA1521e773c21ccfcb30df0d328e031f0b1feb2178b
SHA2562d42ea46ac2d10e47ae7a2f68e3e37498dbc2837165765588b921aef74464ec4
SHA51258468eaf102e029fa7e91d1cb781dda5a4491a8a54345d9203b4bf2700f72e62389f61311190f7f8cd6dffc2d74d18ee86dd7f2e74791956c47096d433edd7e1
-
Filesize
53B
MD59b41ad553fc0a87c014049dfede9e7fa
SHA1840b9c356ec59e65d33bae61c439b0abf11663bd
SHA256a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e
SHA5126de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8
-
Filesize
2KB
MD568a30985a8b4a1dae5b24721ca5b8269
SHA178481107bbddcf18ffc4d25a184ec74274241a6b
SHA256fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf
SHA512d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24
-
Filesize
410B
MD566a1f0147fed7ddd19e9bb7ff93705c5
SHA19d803c81ea2195617379b880b227892ba30b0bf6
SHA2564f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764
SHA512cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597
-
Filesize
3KB
MD5c106ffc420b54a4f0fd331f10657dc66
SHA18930d5b56358f518bdf5ccca2b4d24f98ce7a03f
SHA256fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b
SHA512ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd
-
Filesize
247B
MD5bf915cb73f6126d712c727039ad3d5e6
SHA173ff72a83711c90e45f8bd34505b3284fd2a870b
SHA2563fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940
SHA512752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957
-
Filesize
44KB
MD58522ac3efdf1fac2a56fa3b193e05926
SHA1bcf84a073dcc79da722402704a3db1343606c236
SHA256420d8cd6599fd841d42ed72338c35836195748e51e4671e20a3c2a2edb6dc708
SHA51206125a21c80e87bf778708b1f09eb066fa85f8fb2251458205d719cefece7e30e520dcc7ab0d17abb6547db8e8c4fda3f3465604bd393ef94a1ab7f38b67d3dd