joker | a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35

Analysis

max time kernel
189s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe
Size

160KB
MD5

5e584f27e27a0e4a01d5da75d7857ced
SHA1

691d9790bf3f8848b7341195f7e197d251bc7407
SHA256

a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35
SHA512

375f0802ede27cb478cdfbc0e148634e180f00d3148afacef414823b40428bc42c00b751b0eaaa92d298f54ee2fc34a3ba2580591e124d0b86346ac19c87632d
SSDEEP

1536:7zOEJKTB1rO/A5J2q+MEWafDuwrZd67iS+ra68IUvIi0rQ+m:XXcTBPt+MxJwVEi/8HAz8

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
3252	inlD4E1.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3208	attrib.exe
4228	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\datread\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu4444.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu4444.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu4444.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993534"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1961606143"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993534"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu4444.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu4444.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1961606143"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9D33C9C0-5871-11ED-89AC-520B3B914C01} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?n"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?n"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\datread\\3.bat\""	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4236	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4236	iexplore.exe
4236	iexplore.exe
3680	IEXPLORE.EXE
3680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1156	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	87
PID 3008 wrote to memory of 1156	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	87
PID 3008 wrote to memory of 1156	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	87
PID 1156 wrote to memory of 2040	1156	cmd.exe	89
PID 1156 wrote to memory of 2040	1156	cmd.exe	89
PID 1156 wrote to memory of 2040	1156	cmd.exe	89
PID 2040 wrote to memory of 4236	2040	cmd.exe	91
PID 2040 wrote to memory of 4236	2040	cmd.exe	91
PID 2040 wrote to memory of 456	2040	cmd.exe	92
PID 2040 wrote to memory of 456	2040	cmd.exe	92
PID 2040 wrote to memory of 456	2040	cmd.exe	92
PID 2040 wrote to memory of 3112	2040	cmd.exe	93
PID 2040 wrote to memory of 3112	2040	cmd.exe	93
PID 2040 wrote to memory of 3112	2040	cmd.exe	93
PID 3112 wrote to memory of 3476	3112	cmd.exe	95
PID 3112 wrote to memory of 3476	3112	cmd.exe	95
PID 3112 wrote to memory of 3476	3112	cmd.exe	95
PID 3112 wrote to memory of 3128	3112	cmd.exe	96
PID 3112 wrote to memory of 3128	3112	cmd.exe	96
PID 3112 wrote to memory of 3128	3112	cmd.exe	96
PID 3112 wrote to memory of 424	3112	cmd.exe	97
PID 3112 wrote to memory of 424	3112	cmd.exe	97
PID 3112 wrote to memory of 424	3112	cmd.exe	97
PID 3112 wrote to memory of 2268	3112	cmd.exe	98
PID 3112 wrote to memory of 2268	3112	cmd.exe	98
PID 3112 wrote to memory of 2268	3112	cmd.exe	98
PID 3008 wrote to memory of 3252	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	99
PID 3008 wrote to memory of 3252	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	99
PID 3008 wrote to memory of 3252	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	99
PID 3112 wrote to memory of 3940	3112	cmd.exe	100
PID 3112 wrote to memory of 3940	3112	cmd.exe	100
PID 3112 wrote to memory of 3940	3112	cmd.exe	100
PID 3008 wrote to memory of 4956	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	101
PID 3008 wrote to memory of 4956	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	101
PID 3008 wrote to memory of 4956	3008	a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe	101
PID 3112 wrote to memory of 3208	3112	cmd.exe	102
PID 3112 wrote to memory of 3208	3112	cmd.exe	102
PID 3112 wrote to memory of 3208	3112	cmd.exe	102
PID 3112 wrote to memory of 4228	3112	cmd.exe	103
PID 3112 wrote to memory of 4228	3112	cmd.exe	103
PID 3112 wrote to memory of 4228	3112	cmd.exe	103
PID 3112 wrote to memory of 4488	3112	cmd.exe	105
PID 3112 wrote to memory of 4488	3112	cmd.exe	105
PID 3112 wrote to memory of 4488	3112	cmd.exe	105
PID 3112 wrote to memory of 4396	3112	cmd.exe	106
PID 3112 wrote to memory of 4396	3112	cmd.exe	106
PID 3112 wrote to memory of 4396	3112	cmd.exe	106
PID 4488 wrote to memory of 4684	4488	rundll32.exe	107
PID 4488 wrote to memory of 4684	4488	rundll32.exe	107
PID 4488 wrote to memory of 4684	4488	rundll32.exe	107
PID 4684 wrote to memory of 1296	4684	runonce.exe	108
PID 4684 wrote to memory of 1296	4684	runonce.exe	108
PID 4684 wrote to memory of 1296	4684	runonce.exe	108
PID 4236 wrote to memory of 3680	4236	iexplore.exe	109
PID 4236 wrote to memory of 3680	4236	iexplore.exe	109
PID 4236 wrote to memory of 3680	4236	iexplore.exe	109

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3208	attrib.exe
4228	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe
"C:\Users\Admin\AppData\Local\Temp\a0ab540158a4ac5164ba1b9bef9658dab4b9d51ab082d4197698a01d76498c35.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWW.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4236 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3680
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\1.inf
      4⤵
      PID:456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3476
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3128
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?n"" /f
        5⤵
        
        PID:424
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:2268
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\datread\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:3940
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3208
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4228
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4488
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:1296
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:4396
- C:\Users\Admin\AppData\Local\Temp\inlD4E1.tmp
  C:\Users\Admin\AppData\Local\Temp\inlD4E1.tmp
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A0AB54~1.EXE > nul
  2⤵
  PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5ddb1febcd291eb59d3d67d24a05bfd0

SHA1
fe957affe27cb991f332e7f5c86d3a15359bd3b9

SHA256
ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

SHA512
62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
f2f92af60db53644650f04e506eedb4e

SHA1
831f29328190b5ccac81c03486074dac60591dbd

SHA256
1ddf05a32803a4e78ede1481284134e32615d350e0cc8fe882da150ee1770c8d

SHA512
3215696efa4ed11d6cf8592ea53d39eec036a175e2e94db5012d088098c51ba1c0d02a4dfdb7a24fd80a9efd4770ad35d8741faa6543a0bc80c7b0c9fe8bbcec

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
858B

MD5
d727e34e3f5eb5ee1ce17fe4c66bf617

SHA1
ea796e8b305510775d244f30758e125a01569626

SHA256
d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d

SHA512
ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat

Filesize
54B

MD5
5dd457b845e53fce36e6b543764337e4

SHA1
eb7f8ce82274afa5702b20eb5ba133bb71bcb8d6

SHA256
0a2c605c32f2e9b3eda6f18df3d8c1fc2d87922b9bb23d6c3a9de3aa3f383992

SHA512
0fea97ddf333c178ca4805fc85f8b66f81a7906d1cc7bf440206aff50cc711643e90115f046077a323b3cc78deeb704f7eb8a934d0a1cd011f6a3ad67057c9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlD4E1.tmp

Filesize
57.2MB

MD5
d8fde93d64ac2341bf84fb5f341a9f6e

SHA1
1f283a4e15e635ad90a8f6dcd93957f035cfdb8b

SHA256
7f8cc9c3e4e2fea8e4dda6840ae58b07ebb52543b20321d8ff7af02508a61829

SHA512
f50b00b64dd233d6a94ad55f2d3ed2048ead9ff3bf846a362229dc4bce9178c177a1508688b687de00dcacadd075ff83b9bd2cf4e293167aa947d8bb357f432e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlD4E1.tmp

Filesize
57.2MB

MD5
d8fde93d64ac2341bf84fb5f341a9f6e

SHA1
1f283a4e15e635ad90a8f6dcd93957f035cfdb8b

SHA256
7f8cc9c3e4e2fea8e4dda6840ae58b07ebb52543b20321d8ff7af02508a61829

SHA512
f50b00b64dd233d6a94ad55f2d3ed2048ead9ff3bf846a362229dc4bce9178c177a1508688b687de00dcacadd075ff83b9bd2cf4e293167aa947d8bb357f432e

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.bat

Filesize
3KB

MD5
e580af507ea9f91de910e0c11b1e5ff1

SHA1
998ed9fad171139fca6e0da98f660417fb87fc1c

SHA256
7ab3f848e819dbfe653558a517b6bcd0274040d4e5a0a74e1556916aa5f9d356

SHA512
240d3ed95def600a7b6da7b4ec9f0d2289471d7c96c8bff7198b33d55671004e3b7ad500935d9bd8b7d1cc08ad648b05f1b21c4e958542ac6a150dc3dd4797ab

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.bat

Filesize
3KB

MD5
7c54db0864c2eb965c63c3dfe6be2256

SHA1
303c5edaa7ec4530f88484e3c48ff7e674a676d1

SHA256
1886e568662fcc552a91c3ab25b86e5243032d4f43fa45ffb51c57ca533c4b91

SHA512
60677e5762c2a267269ca520f554b800e88ce80bd96479b0ab02ea9eded76332657c3c9b93961c47551bdea3feda4b1dd88e58ebd087ae42a7853fd4bf0b8997

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.inf

Filesize
248B

MD5
c5eaacddf7fe93d130f1eb67f3fc2d9d

SHA1
ce20a3a2d9925fa4672884ffda2ee200c06ad7ce

SHA256
c740a578ef5867e18bc914ef724c8258a324b4f35591690e91329a10d17f6b45

SHA512
1f9529123cf74f1c53f75d81b9b6dabb127fcef0067c104c5ca044e28450083fa379c256d63d07d4e4053f197c24e02f9e2ab4507f8bb1068032598b52bbbf77

Download Submit
C:\Users\Admin\AppData\Roaming\datread\4.bat

Filesize
5.8MB

MD5
3795b5b7f7bf1393256b4a8f86906673

SHA1
1e1c49a6c84121000dd822a7563f16603d3668b0

SHA256
b2f67dc3f0792ba1c2245dcb54257270a1e51da23e072cf284e2c2f4cba83b0d

SHA512
aa058e80e2ff3e15c6ca33fd6cb38c7042b011d75e70cdf66af08f983128958bcb29f9f4f4b1d8ddbd1f5e07dda52d2da9691c90f83ac8550c4aa5ce27074d8c

Download Submit
memory/3008-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-165-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4236-171-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-203-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-163-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-160-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-162-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-158-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-166-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-169-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-157-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-175-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-149-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-223-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-177-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-178-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-156-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-179-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-167-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-180-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-181-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-183-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-153-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-186-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-189-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-190-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-191-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-192-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-193-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-194-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-195-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-196-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-200-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-201-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-202-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-222-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-204-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-209-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-210-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-211-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-214-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-213-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-212-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-216-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download
memory/4236-217-0x00007FFA7AD00000-0x00007FFA7AD6E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads