joker | e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe
Size

33KB
MD5

8414a54ccaa4798c137b276ecc1c3c7f
SHA1

b636af08fff1212ca37e82f21e1b5390c4e3d335
SHA256

e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f
SHA512

466a160252e60c879200d3a9bb48743dbbd1a1121aedc741ffcb6846bbaca53abd362ae20a243f9bdb956559f1f6a8dac13800acbe26046840afef58bb050498
SSDEEP

768:C4URzUjUI/znSxATOj21M8kMKfpp3Rs4pG:TURzW/uqTs8kpRRs4U

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
4124	inl2B43.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3412	attrib.exe
380	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fsahdsf = "\"C:\\Users\\Admin\\AppData\\Roaming\\lua\\tmp.\\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1444	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993437"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2713347693"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu2222.site	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993437"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993437"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2688817202"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993437"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2713347693"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu2222.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu2222.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2688817202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu2222.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C5F7BC9A-5810-11ED-B696-4A8324823CC0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu2222.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\lua\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\NeverShowExt	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	tasklist.exe
Token: SeIncBasePriorityPrivilege	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2064	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	93
PID 5076 wrote to memory of 2064	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	93
PID 5076 wrote to memory of 2064	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	93
PID 2064 wrote to memory of 2908	2064	cmd.exe	95
PID 2064 wrote to memory of 2908	2064	cmd.exe	95
PID 2064 wrote to memory of 2908	2064	cmd.exe	95
PID 2908 wrote to memory of 3028	2908	cmd.exe	97
PID 2908 wrote to memory of 3028	2908	cmd.exe	97
PID 2908 wrote to memory of 1640	2908	cmd.exe	98
PID 2908 wrote to memory of 1640	2908	cmd.exe	98
PID 2908 wrote to memory of 1640	2908	cmd.exe	98
PID 2908 wrote to memory of 3368	2908	cmd.exe	99
PID 2908 wrote to memory of 3368	2908	cmd.exe	99
PID 2908 wrote to memory of 3368	2908	cmd.exe	99
PID 3368 wrote to memory of 4100	3368	cmd.exe	101
PID 3368 wrote to memory of 4100	3368	cmd.exe	101
PID 3368 wrote to memory of 4100	3368	cmd.exe	101
PID 3368 wrote to memory of 812	3368	cmd.exe	102
PID 3368 wrote to memory of 812	3368	cmd.exe	102
PID 3368 wrote to memory of 812	3368	cmd.exe	102
PID 3368 wrote to memory of 3412	3368	cmd.exe	103
PID 3368 wrote to memory of 3412	3368	cmd.exe	103
PID 3368 wrote to memory of 3412	3368	cmd.exe	103
PID 3368 wrote to memory of 380	3368	cmd.exe	104
PID 3368 wrote to memory of 380	3368	cmd.exe	104
PID 3368 wrote to memory of 380	3368	cmd.exe	104
PID 5076 wrote to memory of 4124	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	105
PID 5076 wrote to memory of 4124	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	105
PID 5076 wrote to memory of 4124	5076	e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe	105
PID 3368 wrote to memory of 4596	3368	cmd.exe	107
PID 3368 wrote to memory of 4596	3368	cmd.exe	107
PID 3368 wrote to memory of 4596	3368	cmd.exe	107
PID 4596 wrote to memory of 4412	4596	rundll32.exe	106
PID 4596 wrote to memory of 4412	4596	rundll32.exe	106
PID 4596 wrote to memory of 4412	4596	rundll32.exe	106
PID 3368 wrote to memory of 1444	3368	cmd.exe	108
PID 3368 wrote to memory of 1444	3368	cmd.exe	108
PID 3368 wrote to memory of 1444	3368	cmd.exe	108
PID 3368 wrote to memory of 2920	3368	cmd.exe	109
PID 3368 wrote to memory of 2920	3368	cmd.exe	109
PID 3368 wrote to memory of 2920	3368	cmd.exe	109
PID 3028 wrote to memory of 4056	3028	iexplore.exe	110
PID 3028 wrote to memory of 4056	3028	iexplore.exe	110
PID 3028 wrote to memory of 4056	3028	iexplore.exe	110
PID 4412 wrote to memory of 1796	4412	runonce.exe	111
PID 4412 wrote to memory of 1796	4412	runonce.exe	111
PID 4412 wrote to memory of 1796	4412	runonce.exe	111
PID 3368 wrote to memory of 3256	3368	cmd.exe	112
PID 3368 wrote to memory of 3256	3368	cmd.exe	112
PID 3368 wrote to memory of 3256	3368	cmd.exe	112
PID 3368 wrote to memory of 1652	3368	cmd.exe	113
PID 3368 wrote to memory of 1652	3368	cmd.exe	113
PID 3368 wrote to memory of 1652	3368	cmd.exe	113
PID 3368 wrote to memory of 2524	3368	cmd.exe	115
PID 3368 wrote to memory of 2524	3368	cmd.exe	115
PID 3368 wrote to memory of 2524	3368	cmd.exe	115
PID 3368 wrote to memory of 5036	3368	cmd.exe	116
PID 3368 wrote to memory of 5036	3368	cmd.exe	116
PID 3368 wrote to memory of 5036	3368	cmd.exe	116
PID 3368 wrote to memory of 5088	3368	cmd.exe	117
PID 3368 wrote to memory of 5088	3368	cmd.exe	117
PID 3368 wrote to memory of 5088	3368	cmd.exe	117
PID 3368 wrote to memory of 4440	3368	cmd.exe	118
PID 3368 wrote to memory of 4440	3368	cmd.exe	118

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3412	attrib.exe
380	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe
"C:\Users\Admin\AppData\Local\Temp\e2664ed981b0869e0b5b864e5f4303718a77f039661796de1205045a86b2586f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4056
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:4100
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:812
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3412
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:380
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4596
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "360tray.exe" tasklist.txt
        5⤵
        
        PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:3256
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:1652
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile" /v "NeverShowExt" /d "" /f
        5⤵
        Modifies registry class
        
        PID:5036
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile\DefaultIcon" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE" /f
        5⤵
        Modifies registry class
        
        PID:5088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.82133.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4440
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.82133.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:5080
- C:\Users\Admin\AppData\Local\Temp\inl2B43.tmp
  C:\Users\Admin\AppData\Local\Temp\inl2B43.tmp
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E2664E~1.EXE > nul
  2⤵
  PID:3852

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\system32\runonce.exe" -r
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\System32\grpconv.exe" -o
  2⤵
  PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
a66314123c8c72372bcb8583a5400a95

SHA1
fc3e45060463c37775da0bd4a8920296d222753d

SHA256
657c92d95798fc5dad4272f3d6d71776737ac0bcdce4ac6864ca5532f2ccf34d

SHA512
d9f5c243b04d7b3fbbcb37c68c583db672390644500cfa4d58280048d9fde52c668fd67e84ecd6ace20b2813eefb756627adbd04a6f19719f6e907aa3fffe4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
689dbbc24b6b02bec667165ee9ae3948

SHA1
485d67481e4349fecde8420b05f14db665be9d56

SHA256
f13f3d4ae74288019f19a30daed4dfba0d24994b3c2b32cb10c8e2dde36009d0

SHA512
55172259093b308a80aad4bef5b9b6468a3e1cce92a7277c50b3599c08727ad1e577a10fd1dc35b2547126cf20ca0114df2053a87ddc382a8ea33140404418a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
1KB

MD5
f7ff8e881393a7c98deb6a9d131efac9

SHA1
4919dc2284a00ae2cd5b425d7eb6608a0c34fea6

SHA256
8f017012d1fc9d4827bba7e56f6aadda2909ba3c19bca79e191adec143e799ea

SHA512
f70b00515fa17c9b974db677ba643e8bab17d2d254a4fd58b96affb463b382c3645c0ad50fbcf1ecabc2e6793630c58ae7a563ad95c8ac3cc9796385c4ec1d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl2B43.tmp

Filesize
57.2MB

MD5
a49e942840744e61ec28fcce3e5c8639

SHA1
7ced888a256232e952b8b5919f9aef9a7f37d313

SHA256
a3f23c5fa54d28fc33c51390bc1f8ab4c27da91c9a2a24fc781f673c8c954dda

SHA512
0e72e47d925bab232e9c4fc70879058195611ae3c241e092e479ff3870a217324a04b6a60ab1e340ab570975ddd07a68b7b81697087b73aec1c60638b5171d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl2B43.tmp

Filesize
57.2MB

MD5
a49e942840744e61ec28fcce3e5c8639

SHA1
7ced888a256232e952b8b5919f9aef9a7f37d313

SHA256
a3f23c5fa54d28fc33c51390bc1f8ab4c27da91c9a2a24fc781f673c8c954dda

SHA512
0e72e47d925bab232e9c4fc70879058195611ae3c241e092e479ff3870a217324a04b6a60ab1e340ab570975ddd07a68b7b81697087b73aec1c60638b5171d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\tasklist.txt

Filesize
7KB

MD5
77287fb5a570ba6d24a3da94db1c2fdf

SHA1
0df60e96b7b32032fb485da5010339359f95deb8

SHA256
02b168b426c0455bfc04472fecdb46f0d90e4502c0c2b847962b28900fbd1c4f

SHA512
4c9f5b5ec7da8b3a3226a85187057a71959c4ac21025a553462d6fcdf0557156bee0c996304741e3f4ebbd804103903f6c3ce9bcd6277098f853ddce2559a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

Filesize
50B

MD5
e08ad52d3d132292f9c51e7cfec5fe08

SHA1
269f7eb185a9ff02664297bfb6f5df9f86ec10f0

SHA256
bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

SHA512
3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.bat

Filesize
2KB

MD5
e9b0ea3bb8833d31df07f7ceaf019e02

SHA1
d147c5363b7fa233cbf2247897a465661f5ad408

SHA256
c9908af4e516f3fe5631e31d099f16f8c4e4d8b91d073003c10a3a0a0bc30fe3

SHA512
4c2a36d0498dd3332ca19e969d1ceaab2a57ef4d12adcc3ffff218a9d72dbfc1622fb22c08215da778821d50d3fd72b0d559f891196176e00459ef01300c9b2b

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.inf

Filesize
424B

MD5
5d8e8066c8e44558a044f4de83b79df2

SHA1
4920014abe179ae430bb55b3c4bdb6966327f551

SHA256
1d51c8abf3a0f5d4b2e61209507052bd12797d12c7821cb8868a0f3cd9950149

SHA512
792b8d0dcb3309ac0513d45e683dbf301ad06d60f4ae770b9d6c0d975eef6b85af17fb3f05fb74866556a11ef0c92f98b20fd81d455ab4b97606257fa782ea81

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.bat

Filesize
8KB

MD5
fad373a616743963bbd11fa966e3f5ac

SHA1
89638961a6a0d6622fa3214e6abc2bc810c549cf

SHA256
2c5b82c6c39cfba12d70cd4080165bd18ce3e65d3e540e2f787b9e7c583eb319

SHA512
956c7d65a3ac45b688fe3ae71f04c664542d03910f8f727ed27fc5d36bf2571d3e397d16ee28ac19512dfa939b8bbd453a307f9d778b84bf689cf32af9a4c39b

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.inf

Filesize
244B

MD5
2de3e6e4faea8c4a10ddd4f26455caca

SHA1
b7c02274aa020619e6c7b925427b027ffcc28629

SHA256
9f29d64886130752a5fe40ce6e83a8f35dc65340871cfe435499a609037c2824

SHA512
0e49cbd89766d3697ce4c9a2c83de32ebaee2d41f1a635a94cf0c73541aaa614f4f5b755f55d21fdea07fc76985bc741f2649abc1c6a32e9876ffa6b3a1c33c8

Download Submit
memory/3028-178-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-194-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-156-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-159-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-154-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-152-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-151-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-163-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-150-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-232-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-165-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-231-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-167-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-149-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-171-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-230-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-173-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-229-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-175-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-176-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-177-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-228-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-180-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-223-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-184-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-144-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-187-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-185-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-143-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-189-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-191-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-222-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-221-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-193-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-155-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-195-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-200-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-201-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-220-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-203-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-205-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-219-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-206-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-218-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-212-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-216-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-214-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/3028-215-0x00007FFDF4980000-0x00007FFDF49EE000-memory.dmp

Filesize
440KB

Download
memory/5076-134-0x0000000000C20000-0x0000000000C35000-memory.dmp

Filesize
84KB

Download
memory/5076-133-0x0000000000DE0000-0x0000000000DE3000-memory.dmp

Filesize
12KB

Download
memory/5076-227-0x0000000000C20000-0x0000000000C35000-memory.dmp

Filesize
84KB

Download
memory/5076-132-0x0000000000C20000-0x0000000000C35000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads