Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 08:12

General

  • Target

    aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe

  • Size

    168KB

  • MD5

    928d6b6564191339000ffd9c19ea9d3a

  • SHA1

    cf3aebdc96d78f638fe154ad2dc00dfb3dff91be

  • SHA256

    aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98

  • SHA512

    6b14c89f8afdf13632c9dec2e76aa8333a6d3143c08b25dd94d52a2cc515b5e69ebb94652cb7bb115bb07aab400abf2d36d6239e5a7cb1cc426e85eb6bf9f805

  • SSDEEP

    1536:aHob+TnkkpRNGojAbnXlkjZ2G+7ErBnOZn2KcGO3Ekm+7UmNhG6n3+s:sOukkJGoEbXldaE5eAK

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe
    "C:\Users\Admin\AppData\Local\Temp\aab4e5e380ba7f128bbbda173e97a6e600002d0082eacdc60ae6d8db0ea59e98.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\teacher2011_check.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1208
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
          4⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:1872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:828
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
            5⤵
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            PID:1284
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
            5⤵
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            PID:1792
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
            5⤵
              PID:1460
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
              5⤵
              • Modifies registry class
              PID:888
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
              5⤵
              • Modifies registry class
              PID:1516
            • C:\Windows\SysWOW64\attrib.exe
              attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
              5⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:1300
            • C:\Windows\SysWOW64\attrib.exe
              attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
              5⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:1148
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
              5⤵
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:1084
              • C:\Windows\SysWOW64\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                6⤵
                • Checks processor information in registry
                PID:1596
                • C:\Windows\SysWOW64\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  7⤵
                    PID:1212
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 D:\VolumeDH\inj.dat,MainLoad
                5⤵
                  PID:1020
          • C:\Users\Admin\AppData\Local\Temp\inl2E73.tmp
            C:\Users\Admin\AppData\Local\Temp\inl2E73.tmp
            2⤵
            • Executes dropped EXE
            PID:2412
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AAB4E5~1.EXE > nul
            2⤵
            • Deletes itself
            PID:2612

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          61KB

          MD5

          3dcf580a93972319e82cafbc047d34d5

          SHA1

          8528d2a1363e5de77dc3b1142850e51ead0f4b6b

          SHA256

          40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

          SHA512

          98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          5fe16a33709401b53939139c446ac5ea

          SHA1

          17492a89d33168432feb107134cd9e125b10a7ad

          SHA256

          40c9d58392e82ce445d1f6692e7b7db82941747e484732f46fe15ca8f2621a9f

          SHA512

          0becaa6fca79b5cb702de6f80fd6a22c4d5123156fc0bb257294b88a0697ea8005a6dba3808b611e58a8d597da2a28d4cde9d73da62db2d88c8a6a06d40aa376

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

          Filesize

          5KB

          MD5

          f60ad1abd3157ceba5e0cdd820d33b96

          SHA1

          9c02253418a338d11367954b22dc35634911c228

          SHA256

          7bb6ef5505b7ef0f84392177d768ee1d71e67ca5e66a35c7726a97bdcbc3df16

          SHA512

          8e093fb61818bed1254a16ae89bfe855fa516c57cb9b6f5eafbe629f5fd5e14e0c83252e53802251a734885858e5fe3e5487ef94729e26948ac11eb410143610

        • C:\Users\Admin\AppData\Local\Temp\inl2E73.tmp

          Filesize

          114.1MB

          MD5

          7cde9b109a70a2194dc360f07fc37907

          SHA1

          aefba29edf70c582876db3a14f5805acc39a61ac

          SHA256

          12ca514916872f5168bbe89e3e499201111bd3e5418afdbcdccb5d8302524d3e

          SHA512

          7ffdd157aefff1fda388e22d8d30f9a34a2acb90d92f5eb7489284372f29c2a9bd35b8117b841c054f5d34125c619d39b390c56ffac338cb97d7dc53bc1ceeb2

        • C:\Users\Admin\AppData\Local\Temp\teacher2011_check.bat

          Filesize

          53B

          MD5

          23962a245f75fe25510051582203aff1

          SHA1

          20832a3a1179bb2730194d2f7738d41d5d669a43

          SHA256

          1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

          SHA512

          dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

        • C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

          Filesize

          660B

          MD5

          c40ea8f677b3f48bfb7f4cfc6d3f03ab

          SHA1

          10b94afd8e6ea98a3c8a955304f9ce660b0c380a

          SHA256

          b1a31a74cc88d0f8e39aaebf58a724b89391dc3fbac733953790edf8ded8172c

          SHA512

          409b8a45576bf08e185446b13a512c115df7483ff8ec30ea51ee93ee1ac8153ae3b615650ff69a5d1e41fa0cd57fcdc4c5d03b4b4453431114ac018f48e194d9

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\E4P49364.txt

          Filesize

          608B

          MD5

          22606620b4d462c5012039f7892afc29

          SHA1

          41f7b78324b66a98eca6f0826737cb7afbd292de

          SHA256

          c7d61af774e6bcdc8cffdec278f212da2cc79c89d68c689d53c40b6478df0f57

          SHA512

          80db4f72ad1ccf80bf78bb31b3f101ab88961471a62f1ddae071b8279edc9233421697f3537bb60cb94213c569979875740bd9d7bc33aa1171b1f22fdd0ca84c

        • C:\Users\Admin\AppData\Roaming\PPLive\1.bat

          Filesize

          3KB

          MD5

          b7c5e3b416b1d1b5541ef44662e1a764

          SHA1

          8bff7ea2be2f3cf29f2381d8007198b5991ca3ae

          SHA256

          f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1

          SHA512

          65dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc

        • C:\Users\Admin\AppData\Roaming\PPLive\1.inf

          Filesize

          492B

          MD5

          34c14b8530e1094e792527f7a474fe77

          SHA1

          f71c4e9091140256b34c18220d1dd1efab1f301d

          SHA256

          fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

          SHA512

          25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

        • C:\Users\Admin\AppData\Roaming\PPLive\2.bat

          Filesize

          3KB

          MD5

          6b78cb8ced798ca5df5612dd62ce0965

          SHA1

          5a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf

          SHA256

          81f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3

          SHA512

          b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e

        • C:\Users\Admin\AppData\Roaming\PPLive\2.inf

          Filesize

          247B

          MD5

          ca436f6f187bc049f9271ecdcbf348fa

          SHA1

          bf8a548071cfc150f7affb802538edf03d281106

          SHA256

          6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

          SHA512

          d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

        • C:\Users\Admin\AppData\Roaming\PPLive\4.bat

          Filesize

          12.3MB

          MD5

          878e21036cd106c25d9c9e351a807f0a

          SHA1

          3238ac0d42a8be7e35909732b49435efd26589f0

          SHA256

          825ad3e3421c4fdf026299c5d7002ffe953d725e909aa2dee3ff32febb45788a

          SHA512

          dd4581133b44ae676bf1094ab0ccc7eed271a3d6236797102a99fab65756b50ba8ede5a6f20edeb1ce04bca26860b48eb48647a1f82e85cd426dcf8aa9bb8b35

        • \Users\Admin\AppData\Local\Temp\inl2E73.tmp

          Filesize

          117.1MB

          MD5

          6e0f0e3a21f65eee32da1dd2d5755633

          SHA1

          955480858996ea06d71b193a3e28415093594e68

          SHA256

          d6103111c6845c82231640297a0f974c35178e33b48999d68f0662ef80194133

          SHA512

          3044d1aa786d487becec84c72c8b2f0a32b6feb46415ab74b4613edaf440ae2ab584d60b9bc184c5c61cccfd414b87b4e84ddb2631c14dcac58f4d0661536bd4

        • \Users\Admin\AppData\Local\Temp\inl2E73.tmp

          Filesize

          110.6MB

          MD5

          fa931f31f009320d46c1ca12ea5dedbe

          SHA1

          1cf8d1383b3bda669f09e8412ad195a8ce626719

          SHA256

          8c1c3b137a79971bc07a27b75cb0745d2a5b354a086263ac22ec7ab7e5de06f2

          SHA512

          47a216d4519b960c13c600dd3dc1ab283b10dce7aad0de0d392d271ae58d18771c84730b11d7c8da2440f0e138fe6d9815370118aea34d575688cbac26e8fdb7

        • memory/1652-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

          Filesize

          8KB

        • memory/1652-91-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/1652-55-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB