joker | e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5

Analysis

max time kernel
169s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe
Size

96KB
MD5

93183277d652b823134344a9b0370bcc
SHA1

b567859456f228b24646ce07a63fd750ee221732
SHA256

e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5
SHA512

650b7145df7e7a8f909f4afeb528005382138cb700f96b234f7295bdad993b0af6c6811127a28c8204be08cc8df66d793b6eabb03acb1cf7715a8e429278cd24
SSDEEP

768:Ry837t4FkXJREB8XFsWf5xq/qo/k08qkM7B1YlhrIWV35xqu+TPW1Kljl9nnQObh:R4PuXFpfTtbrO/A5HN+TOC+eWxGsn+R

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
1340	inl2B24.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4864	attrib.exe
2592	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fsahdsf = "\"C:\\Users\\Admin\\AppData\\Roaming\\lua\\tmp.\\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
396	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu5555.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu5555.site\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993574"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000c50e8ec681e2f9e74668fb61801aa631c77161fbf71786e4e84b6f893225d101000000000e80000000020000200000006dae8fe5c91ab8ab9b6bc30e55bf8351af22f33fc0bae546eb0538c348bed6d420000000fcae51ebfef5feeac00673436007375863ab91e6065369b83e48ea22da1f4155400000007125e6a3ca9097869cecccdd4703793c11237af127880b87144762b6203757a4bc511998dbb90e1c36a81cbb00a0826e0c630be1000a70214f6eb9db77fd3728	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000003ac9df1d7f116321f0e76c644d661ac8627c7606a2d0fb269aa8d12c9a819af6000000000e8000000002000020000000b9590f0730d547ec42bbad7be1179c641391ab45d40d6327e0cefd15c8093b28200000004615838acd3a326263df07ae8842ccbd04b6100cb503552f8f53f2fe5c044ad640000000eee45c0b022d4ae25c05209646e477896ba56aaa7925fdbfae51b1bf90dbd1ad1a95f26c7ef6be67c73bec0f653587b09e4147f496d2ef9c1d9988accb843cad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu5555.site	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4181321834"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d0c109a7ecd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu5555.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4179134419"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993574"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2389BCDE-589A-11ED-89AC-D2371B4A40BE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4181321834"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu5555.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993574"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4179134419"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993574"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ef760aa7ecd801	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\lua\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\NeverShowExt	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3488	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeIncBasePriorityPrivilege	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1356	iexplore.exe
1356	iexplore.exe
4588	IEXPLORE.EXE
4588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3748	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	85
PID 4552 wrote to memory of 3748	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	85
PID 4552 wrote to memory of 3748	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	85
PID 3748 wrote to memory of 3728	3748	cmd.exe	87
PID 3748 wrote to memory of 3728	3748	cmd.exe	87
PID 3748 wrote to memory of 3728	3748	cmd.exe	87
PID 3728 wrote to memory of 1356	3728	cmd.exe	89
PID 3728 wrote to memory of 1356	3728	cmd.exe	89
PID 3728 wrote to memory of 4924	3728	cmd.exe	90
PID 3728 wrote to memory of 4924	3728	cmd.exe	90
PID 3728 wrote to memory of 4924	3728	cmd.exe	90
PID 3728 wrote to memory of 3772	3728	cmd.exe	91
PID 3728 wrote to memory of 3772	3728	cmd.exe	91
PID 3728 wrote to memory of 3772	3728	cmd.exe	91
PID 4552 wrote to memory of 1340	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	93
PID 4552 wrote to memory of 1340	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	93
PID 4552 wrote to memory of 1340	4552	e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe	93
PID 1356 wrote to memory of 4588	1356	iexplore.exe	94
PID 1356 wrote to memory of 4588	1356	iexplore.exe	94
PID 1356 wrote to memory of 4588	1356	iexplore.exe	94
PID 3772 wrote to memory of 3488	3772	cmd.exe	95
PID 3772 wrote to memory of 3488	3772	cmd.exe	95
PID 3772 wrote to memory of 3488	3772	cmd.exe	95
PID 3772 wrote to memory of 3136	3772	cmd.exe	96
PID 3772 wrote to memory of 3136	3772	cmd.exe	96
PID 3772 wrote to memory of 3136	3772	cmd.exe	96
PID 3772 wrote to memory of 1524	3772	cmd.exe	99
PID 3772 wrote to memory of 1524	3772	cmd.exe	99
PID 3772 wrote to memory of 1524	3772	cmd.exe	99
PID 3772 wrote to memory of 4200	3772	cmd.exe	100
PID 3772 wrote to memory of 4200	3772	cmd.exe	100
PID 3772 wrote to memory of 4200	3772	cmd.exe	100
PID 3772 wrote to memory of 4864	3772	cmd.exe	101
PID 3772 wrote to memory of 4864	3772	cmd.exe	101
PID 3772 wrote to memory of 4864	3772	cmd.exe	101
PID 3772 wrote to memory of 2592	3772	cmd.exe	102
PID 3772 wrote to memory of 2592	3772	cmd.exe	102
PID 3772 wrote to memory of 2592	3772	cmd.exe	102
PID 3772 wrote to memory of 4000	3772	cmd.exe	103
PID 3772 wrote to memory of 4000	3772	cmd.exe	103
PID 3772 wrote to memory of 4000	3772	cmd.exe	103
PID 3772 wrote to memory of 396	3772	cmd.exe	104
PID 3772 wrote to memory of 396	3772	cmd.exe	104
PID 3772 wrote to memory of 396	3772	cmd.exe	104
PID 4000 wrote to memory of 3836	4000	rundll32.exe	105
PID 4000 wrote to memory of 3836	4000	rundll32.exe	105
PID 4000 wrote to memory of 3836	4000	rundll32.exe	105
PID 3836 wrote to memory of 3656	3836	runonce.exe	106
PID 3836 wrote to memory of 3656	3836	runonce.exe	106
PID 3836 wrote to memory of 3656	3836	runonce.exe	106
PID 3772 wrote to memory of 3484	3772	cmd.exe	107
PID 3772 wrote to memory of 3484	3772	cmd.exe	107
PID 3772 wrote to memory of 3484	3772	cmd.exe	107
PID 3772 wrote to memory of 3956	3772	cmd.exe	108
PID 3772 wrote to memory of 3956	3772	cmd.exe	108
PID 3772 wrote to memory of 3956	3772	cmd.exe	108
PID 3772 wrote to memory of 3912	3772	cmd.exe	109
PID 3772 wrote to memory of 3912	3772	cmd.exe	109
PID 3772 wrote to memory of 3912	3772	cmd.exe	109
PID 3772 wrote to memory of 1944	3772	cmd.exe	111
PID 3772 wrote to memory of 1944	3772	cmd.exe	111
PID 3772 wrote to memory of 1944	3772	cmd.exe	111
PID 3772 wrote to memory of 1752	3772	cmd.exe	112
PID 3772 wrote to memory of 1752	3772	cmd.exe	112

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4864	attrib.exe
2592	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe
"C:\Users\Admin\AppData\Local\Temp\e5b15c95ea0a3ff4990cf2e7e8fc7c10d2ffe2ce15945b0be9615384444411e5.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4588
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /t REG_SZ /d .bat /f
        5⤵
        Modifies registry key
        
        PID:3488
    - - C:\Windows\SysWOW64\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:1524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:4200
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{D71C5380-D2A0-CD69-E3EE-E1002B3A309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4864
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2592
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:3656
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
    - - C:\Windows\SysWOW64\find.exe
        
        find /i "360tray.exe" tasklist.txt
        5⤵
        
        PID:3484
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:3956
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /d "1" /f
        5⤵
        
        PID:3912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile" /v "NeverShowExt" /d "" /f
        5⤵
        Modifies registry class
        
        PID:1944
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\htafile\DefaultIcon" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE" /f
        5⤵
        Modifies registry class
        
        PID:1752
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.82133.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3612
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.82133.com/?S" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3556
- C:\Users\Admin\AppData\Local\Temp\inl2B24.tmp
  C:\Users\Admin\AppData\Local\Temp\inl2B24.tmp
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E5B15C~1.EXE > nul
  2⤵
  PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5ddb1febcd291eb59d3d67d24a05bfd0

SHA1
fe957affe27cb991f332e7f5c86d3a15359bd3b9

SHA256
ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

SHA512
62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
1b71126861369cdf41700bbcce834e1b

SHA1
b2c6e5dcf3e31d3088671252dde8876370dba432

SHA256
eb2e862ef2acff44275feb3d6a97a5d5ed63ce76d2df9dbeb3fad12e61867522

SHA512
0b64cf6b839b17e3371e351ad19952a5022e6a37164ae5ce76b43df9aae5a3ddf4f64d9d53a9178b10f61158f6bce6013ece955b00acb6528f7143897a8629c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat

Filesize
1KB

MD5
45e579d0c806e4e8bb625eba7f00b25d

SHA1
b77ffa8e5f395633ab5007a4df9b4e6f0d7038bd

SHA256
35587bb7cad1628275a22eb38d0de3398c83223720d017db7d072885af66783a

SHA512
e782f0cdc4a8dd84593b304c999d175d1375d8e72357842f3e1f31bf0bc83f53ab685e868d52e66969eb59b872820fd0a76128b4bd874b887f5d37ffad758f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
894B

MD5
8cd2b7d34c222e5118aefc6049e401f6

SHA1
b87db67d32e16177ed4e334660d692507d9d4780

SHA256
28624e54fb4c19855631f5479b37d6519c9cd342b1a400a8448ce29f5693fa8f

SHA512
b671641c06efb38bf453c320985d8461cb43ca0b58d48846b214463a5cf45c437d4350681a6e475631365bee56a4c8ea3c27b6ee801929c083aaa7c266af45f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl2B24.tmp

Filesize
57.2MB

MD5
8519a52b13f2777177536b9bb3a81260

SHA1
1f94f44ec71e794005f6b351cc593fdef1da764d

SHA256
a9d1e6ac4c7d0e888840692ca7a33ce30556c02e92d7b514d333fa2ac5ce3b63

SHA512
200c097562569b1deaae157058e8e9fbe824bfbc4457ee5e1f0f896061feec268076c49bddf8fc44cbcb69c146af433e45bd4fd65fe6d4f239108b8bf0ab5215

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl2B24.tmp

Filesize
57.2MB

MD5
8519a52b13f2777177536b9bb3a81260

SHA1
1f94f44ec71e794005f6b351cc593fdef1da764d

SHA256
a9d1e6ac4c7d0e888840692ca7a33ce30556c02e92d7b514d333fa2ac5ce3b63

SHA512
200c097562569b1deaae157058e8e9fbe824bfbc4457ee5e1f0f896061feec268076c49bddf8fc44cbcb69c146af433e45bd4fd65fe6d4f239108b8bf0ab5215

Download Submit
C:\Users\Admin\AppData\Local\Temp\tasklist.txt

Filesize
6KB

MD5
4f17b72aae5e4ed70a5ffbfe5a323340

SHA1
2b05bb93c561d1ef7218325bf9d997ca83746cfd

SHA256
3a7f1aeed3f5f84e21a4439b922089ccdd83658b558bc38d3b204c5c3b9effab

SHA512
9a20274135a4f28d13c7c84190dbd4a87d15803737a888c7a6c7f80c7ec760d5617f7fef96b25575edf0c06179e912bc718c047958f21ea04db5b1c36efc4e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

Filesize
50B

MD5
e08ad52d3d132292f9c51e7cfec5fe08

SHA1
269f7eb185a9ff02664297bfb6f5df9f86ec10f0

SHA256
bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

SHA512
3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.bat

Filesize
2KB

MD5
d720afa7c1bc6d67157c1fc5e1804f5f

SHA1
372cb41239edb1f4452a67b2c116cd4016b0f608

SHA256
fa0eaebd30bad6d62a875ff2bbd6861750cdf63ef811e620d95584337d8805e3

SHA512
1f4b6dffc79fbdac3868dbd9c9654374eaf28600053dcf041dcc0bbfdfb7d6610d29b8edabf0a88d3d298e8877f927c6f0600fca41ccb1e7d4aaed44ea1d3f1e

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.bat

Filesize
8KB

MD5
7b2cc87165c7598cd390c0f7cf4d6717

SHA1
04fd7ce74a29e2df543b9f3eca0bf8f82064f5af

SHA256
4f9d55cf344b944fd73ed63560ee9bf9130f124d593502b5a67abab2586bcd62

SHA512
0d8ca7b61c3a1d69b571063c2d43b623f2fac296e8f9c0dda1103212546632356aeaac6b21de1097ed54682aeccd5a68d8ef08f03f6ad0fc2bd386c7f52bc996

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.inf

Filesize
244B

MD5
2de3e6e4faea8c4a10ddd4f26455caca

SHA1
b7c02274aa020619e6c7b925427b027ffcc28629

SHA256
9f29d64886130752a5fe40ce6e83a8f35dc65340871cfe435499a609037c2824

SHA512
0e49cbd89766d3697ce4c9a2c83de32ebaee2d41f1a635a94cf0c73541aaa614f4f5b755f55d21fdea07fc76985bc741f2649abc1c6a32e9876ffa6b3a1c33c8

Download Submit
memory/1356-210-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-189-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-150-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-152-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-154-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-139-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-157-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-159-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-160-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-161-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-162-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-148-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-147-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-146-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-145-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-168-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-144-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-143-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-171-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-173-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-175-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-176-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-177-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-140-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-178-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-179-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-180-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-181-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-142-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-183-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-187-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-188-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-149-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-190-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-191-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-196-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-198-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-199-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-197-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-200-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-201-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-203-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-204-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/1356-209-0x00007FFE9BE60000-0x00007FFE9BECE000-memory.dmp

Filesize
440KB

Download
memory/4552-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4552-233-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4552-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads