Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 07:49

General

  • Target

    bb69b4bc7f1948e729323fb63ca23c46436fd35ba92a2c293eb2382ff22684ca.exe

  • Size

    45KB

  • MD5

    a27e847e90100148c106b6cf4bdd31ba

  • SHA1

    af284a31600f33ec9eb50d7021d42ce4799df3b5

  • SHA256

    bb69b4bc7f1948e729323fb63ca23c46436fd35ba92a2c293eb2382ff22684ca

  • SHA512

    4da44921258a69fcafb00327eb69acb37d069e813bc35d852500910b8eaf8162b72983c47a0b11980b30d98c6f04ad7f2787209d5bf0f392eaf542e78008d900

  • SSDEEP

    768:5RVZwlepBH12mX3uN3aO74s9dcKDI0GZTg70Wq1qtewJJgzY4Dyu:5RAepBAmnuhN74k6GIhfWa8izY4H

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb69b4bc7f1948e729323fb63ca23c46436fd35ba92a2c293eb2382ff22684ca.exe
    "C:\Users\Admin\AppData\Local\Temp\bb69b4bc7f1948e729323fb63ca23c46436fd35ba92a2c293eb2382ff22684ca.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3892
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
          4⤵
            PID:2812
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
            4⤵
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2536
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:3168
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:3056
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
              5⤵
                PID:2284
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:4352
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:1760
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:2832
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:4712
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 D:\VolumeDH\inj.dat,MainLoad
                5⤵
                  PID:2728
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
                  5⤵
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:4296
                  • C:\Windows\SysWOW64\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    6⤵
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4908
                    • C:\Windows\SysWOW64\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      7⤵
                        PID:460
            • C:\Users\Admin\AppData\Local\Temp\inl954.tmp
              C:\Users\Admin\AppData\Local\Temp\inl954.tmp
              2⤵
              • Executes dropped EXE
              PID:524
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BB69B4~1.EXE > nul
              2⤵
                PID:3272

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              5ddb1febcd291eb59d3d67d24a05bfd0

              SHA1

              fe957affe27cb991f332e7f5c86d3a15359bd3b9

              SHA256

              ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

              SHA512

              62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              434B

              MD5

              a571d929cb774f4f32ed0fd7151850db

              SHA1

              8d68802dc2dcdbbc4d5afe4b59df55f7775a454a

              SHA256

              8b12caac48f18ffc186454a5e846962d2ff7d42aacec70525f05a68c3ea1c207

              SHA512

              f8de8889d660286efd9b8dead9953fa53ccf893dc1b688bfea67a3a02628319a724e8a63a99f7279f93e79ac3bf6679b731b18062691141c4f64c5e69f1c8e2f

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat

              Filesize

              1KB

              MD5

              132e0c77a724115ef3db9abe3aae7421

              SHA1

              909f29d23e7869b4046111b45ef70653bb758fb7

              SHA256

              8d799865ef2624dea06e18afaa966d2f8457e7e7e9a2bfad02e28279127e0ee9

              SHA512

              adc6f4919a8799d52878fef8982435ebbf5e274e5b8b2b1d13d196e5eac7edd16701e43c3cffa44c8bceab661d9a4485b96a90b86ea5ed7d5ecc41dc63855df4

            • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

              Filesize

              906B

              MD5

              f2572338cb20db1d928b2c61282e6e87

              SHA1

              8b2b79ef1c914b0b00ec10a06caa8638b2163d45

              SHA256

              e9bc7df9f665d307b049d0d8bf74ed3c2ac1564094d3c4eff2568742bb5ebbbd

              SHA512

              240c9e2b2de396ef9dbe6b823723c61ba12c50e9a3b11f5f8f826aa55984d6c18a83361bf5b8f5d2602dbf8152e9feb35ceadce11d098aed246c52dc02771763

            • C:\Users\Admin\AppData\Local\Temp\inl954.tmp

              Filesize

              57.2MB

              MD5

              6b8c9350dd0a3eab141c1dff9e50472a

              SHA1

              3361357d1ecc98a0e3a72413e627da5c8a4b7fa0

              SHA256

              47d2fed0e319ced46f2dd09445aeacbb20c5cc53bf9715c4772a4d8f65e5f6ec

              SHA512

              1e98633b51f43de3ab46e9367edebd384bea8f0e653b034b90a1880a865ab6c3c0995e81a62ddbc616598bd085556edfb551837dc10626cff8fe380ec01717a2

            • C:\Users\Admin\AppData\Local\Temp\inl954.tmp

              Filesize

              57.2MB

              MD5

              6b8c9350dd0a3eab141c1dff9e50472a

              SHA1

              3361357d1ecc98a0e3a72413e627da5c8a4b7fa0

              SHA256

              47d2fed0e319ced46f2dd09445aeacbb20c5cc53bf9715c4772a4d8f65e5f6ec

              SHA512

              1e98633b51f43de3ab46e9367edebd384bea8f0e653b034b90a1880a865ab6c3c0995e81a62ddbc616598bd085556edfb551837dc10626cff8fe380ec01717a2

            • C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

              Filesize

              50B

              MD5

              e08ad52d3d132292f9c51e7cfec5fe08

              SHA1

              269f7eb185a9ff02664297bfb6f5df9f86ec10f0

              SHA256

              bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

              SHA512

              3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

            • C:\Users\Admin\AppData\Roaming\lua\1.bat

              Filesize

              2KB

              MD5

              68a30985a8b4a1dae5b24721ca5b8269

              SHA1

              78481107bbddcf18ffc4d25a184ec74274241a6b

              SHA256

              fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf

              SHA512

              d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24

            • C:\Users\Admin\AppData\Roaming\lua\1.inf

              Filesize

              410B

              MD5

              66a1f0147fed7ddd19e9bb7ff93705c5

              SHA1

              9d803c81ea2195617379b880b227892ba30b0bf6

              SHA256

              4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

              SHA512

              cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

            • C:\Users\Admin\AppData\Roaming\lua\2.bat

              Filesize

              3KB

              MD5

              c106ffc420b54a4f0fd331f10657dc66

              SHA1

              8930d5b56358f518bdf5ccca2b4d24f98ce7a03f

              SHA256

              fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b

              SHA512

              ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd

            • C:\Users\Admin\AppData\Roaming\lua\2.inf

              Filesize

              244B

              MD5

              524023ba7f18bfc502d22dbaade4571e

              SHA1

              fc118e1284db4e36da41d5cc4496ffa9a8b7cd2e

              SHA256

              5d170c83ca9a16ed7f62145099b3b8b0c0a1d4187e60bb0719754cb6ed40fc4c

              SHA512

              22384a0854a9949209444d9e7af3016327ad698e56797af246e02604b880949f40c7f4627303c11d73581c681b93bcee285b3937d4088c61107b9ec73901bdbc

            • C:\Users\Admin\AppData\Roaming\lua\4.bat

              Filesize

              44KB

              MD5

              8639815b7bda81055eaba69766f4c83c

              SHA1

              fcd1aacf535d0e948a8ff8104126040d1efb5bb3

              SHA256

              cf1b5e5145057f947af3ab59060e7b184975c66a68d4076732774a572f8376c8

              SHA512

              02268150ae0042dc1b8fda8d2d31b8d94058ade4fff8244a60ba8580f464e1bb5cec4a77448ba730389f9680b27742a697174c5efe2c1ddccb342ab01a5b0954

            • memory/2716-178-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-187-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-145-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-155-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-156-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-158-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-159-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-160-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-161-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-148-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-162-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-164-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-165-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-167-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-151-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-152-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-150-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-170-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-147-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-176-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-225-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-177-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-179-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-224-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-219-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-181-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-218-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-184-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-185-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-216-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-153-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-191-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-192-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-143-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-215-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-142-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-214-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-213-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-198-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-212-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-210-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-202-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/2716-203-0x00007FFA03A60000-0x00007FFA03ACE000-memory.dmp

              Filesize

              440KB

            • memory/4148-132-0x0000000000C40000-0x0000000000C5F000-memory.dmp

              Filesize

              124KB

            • memory/4148-183-0x0000000000C40000-0x0000000000C5F000-memory.dmp

              Filesize

              124KB

            • memory/4148-135-0x0000000000C40000-0x0000000000C5F000-memory.dmp

              Filesize

              124KB

            • memory/4148-134-0x00000000007D0000-0x00000000007D3000-memory.dmp

              Filesize

              12KB

            • memory/4148-133-0x00000000007D0000-0x00000000007D3000-memory.dmp

              Filesize

              12KB