Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2022, 09:06

General

  • Target

    15954a097d41c83ef033163aa198da1fb7521aff93c6b748127f0abfcbeff388.exe

  • Size

    1.3MB

  • MD5

    752212855e6d8e71e8c293377aa38f76

  • SHA1

    ea9af2c88058c3a86f195887e41f5983570aa595

  • SHA256

    15954a097d41c83ef033163aa198da1fb7521aff93c6b748127f0abfcbeff388

  • SHA512

    09519cfcac1b6e38a1ad3c6299e196cf8e2cfc7feee51dde4cd2bc322e9b3960ae1967440ad25640d10047a09a5f693b08e2aece78f26cae8a13666441efbeb9

  • SSDEEP

    24576:EEsZg89x5NU+wnzihMeDfWmASWKBzTXBfxztO9gsKlWX7ufBnjFrgetmCq:EEsJnEevhTHZOyRa7uZnB1tDq

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15954a097d41c83ef033163aa198da1fb7521aff93c6b748127f0abfcbeff388.exe
    "C:\Users\Admin\AppData\Local\Temp\15954a097d41c83ef033163aa198da1fb7521aff93c6b748127f0abfcbeff388.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:2276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads