Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 07:49

General

  • Target

    90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe

  • Size

    140KB

  • MD5

    a28879e242248d3868b6a5da8c972e69

  • SHA1

    865b6f731ad1eec562f67a0946100a2e79c57c3b

  • SHA256

    90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c

  • SHA512

    edcba61c228c683adcd2f4da6df04788dd5a5300c2bb0c8bbf1f3b58166b8323bc839e12436faf5f8954aa5d2bbcc41b63d5818066216a750de8c25f8477de90

  • SSDEEP

    1536:UnM12OVLjlevyaRLBnLuRgiaZxRIxecePKH56Hdb+F:bPLpeTLlamiaZxRIxecePKyc

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe
    "C:\Users\Admin\AppData\Local\Temp\90b5f9799cd1148545549b34d62b04907a7499713e95cf63bfdc11e503c8f27c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:792
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2312
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1756
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf
          4⤵
            PID:1224
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat
            4⤵
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:1004
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:1816
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?S"" /f
              5⤵
                PID:3500
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:4712
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:1040
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:4480
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:5096
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf
                5⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:3020
                • C:\Windows\SysWOW64\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:4416
                  • C:\Windows\SysWOW64\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    7⤵
                      PID:3156
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 D:\VolumeDH\inj.dat,MainLoad
                  5⤵
                    PID:2400
            • C:\Users\Admin\AppData\Local\Temp\inl653F.tmp
              C:\Users\Admin\AppData\Local\Temp\inl653F.tmp
              2⤵
              • Executes dropped EXE
              PID:3716
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\90B5F9~1.EXE > nul
              2⤵
                PID:3532

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              5ddb1febcd291eb59d3d67d24a05bfd0

              SHA1

              fe957affe27cb991f332e7f5c86d3a15359bd3b9

              SHA256

              ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

              SHA512

              62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              434B

              MD5

              29dc8d6f9cbe091f1e93625e45f23e02

              SHA1

              e972166dee5a5746a9cec38de62acb47f36866bd

              SHA256

              ff339efdccc6c5311e6e316f3a6e3525836b50538e9f5d3da9ec27674673b5b3

              SHA512

              afe40bf8d356fa8c4fc53458dba013d9a7016249723570bbd1590aae74367381ebb56a3c8721d8345db60fdb581429b3c451a6829636acdbbb6c2197baf2c52b

            • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

              Filesize

              1KB

              MD5

              ab301ff15c000838c221b76a00aecb93

              SHA1

              a9bd18bb6340c7055fdb627d85bf6f90a48eca21

              SHA256

              5df478abe9d623d2707ca39a73259cbe95da2c824d23ed44454f55c5d67e6884

              SHA512

              0cb9e594bbd0d27f03a0553255a0b238243147154c2bfc07a2a915369153185003087e47cd582f84f0dad954ea508896cce1387f596604f93e47287fe46e42e7

            • C:\Users\Admin\AppData\Local\Temp\inl653F.tmp

              Filesize

              57.2MB

              MD5

              3daf9f8de52b29e7972ba492a98cd42e

              SHA1

              1e257e056ce96ad76cecc2189cd8b668360921fe

              SHA256

              62db3a3bb1a217b3e0cd46053b2d0f169d08d8c1353a19ec2f09811f1686cb2a

              SHA512

              141cecd8dda37ae533ae382a57a6982520e4d4e1171edb7e60c5f189a1ab2ed8210964628252d95fb35042a745c98e752e82e27e754531b4d3623695a90f1996

            • C:\Users\Admin\AppData\Local\Temp\inl653F.tmp

              Filesize

              57.2MB

              MD5

              3daf9f8de52b29e7972ba492a98cd42e

              SHA1

              1e257e056ce96ad76cecc2189cd8b668360921fe

              SHA256

              62db3a3bb1a217b3e0cd46053b2d0f169d08d8c1353a19ec2f09811f1686cb2a

              SHA512

              141cecd8dda37ae533ae382a57a6982520e4d4e1171edb7e60c5f189a1ab2ed8210964628252d95fb35042a745c98e752e82e27e754531b4d3623695a90f1996

            • C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat

              Filesize

              53B

              MD5

              9b41ad553fc0a87c014049dfede9e7fa

              SHA1

              840b9c356ec59e65d33bae61c439b0abf11663bd

              SHA256

              a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e

              SHA512

              6de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8

            • C:\Users\Admin\AppData\Roaming\winzip\1.bat

              Filesize

              2KB

              MD5

              582695c0131019067973d3870c8c9bca

              SHA1

              575da5536074707385418985375d6735fec7de77

              SHA256

              4dd7bb56ca6f2e48cd57ceafcd79ff31c11ce2d474d777ee5c9e16c5bfbf3e9c

              SHA512

              ea59965f427ca826734115290e42ed9a2b7db66853474a735c0add16b5e0f2e799fe7586aa2114443797d3ea02c09e36523d072dc12be38c9be5ddbab6083231

            • C:\Users\Admin\AppData\Roaming\winzip\1.inf

              Filesize

              410B

              MD5

              66a1f0147fed7ddd19e9bb7ff93705c5

              SHA1

              9d803c81ea2195617379b880b227892ba30b0bf6

              SHA256

              4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

              SHA512

              cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

            • C:\Users\Admin\AppData\Roaming\winzip\2.bat

              Filesize

              3KB

              MD5

              2cc7ab0e0e60b07b036165b5359b4f29

              SHA1

              ce5d46d531e37bb52ac4983c061963223b043052

              SHA256

              52ed22e575304c981f0f44c771fdd7d4fe185ecfba4ff9e3ac24986686e58be9

              SHA512

              35bb22bf0c253a0d099f6fbf92ebea36714a674459f7185bce8267aee79ddceeef010a86b3e0f5a1aa9af0d7d3843c4a905a171529e19472543c916b7c926746

            • C:\Users\Admin\AppData\Roaming\winzip\2.inf

              Filesize

              247B

              MD5

              bf915cb73f6126d712c727039ad3d5e6

              SHA1

              73ff72a83711c90e45f8bd34505b3284fd2a870b

              SHA256

              3fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940

              SHA512

              752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957

            • C:\Users\Admin\AppData\Roaming\winzip\4.bat

              Filesize

              44KB

              MD5

              69509720f2e7eec902005695aa5ba00d

              SHA1

              673df7e523392e250e2655976de688f7e6ba7985

              SHA256

              cd35e68248dbc944d2683f46d24d67c81cac6bbcb13d5d49adb8c1af956efd69

              SHA512

              a38f252167f90edaa7a130d1c5891105a7dc749b9b4350b29308823df6fc20ddc775485448f5da29a1f1f6909c5c3c7cdeeb4564ed10804a7fdcb72f41fcd1a9

            • memory/544-132-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB

            • memory/544-208-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB

            • memory/2312-176-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-191-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-153-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-154-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-157-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-156-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-159-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-162-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-163-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-151-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-224-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-168-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-149-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-146-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-170-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-148-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-171-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-144-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-223-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-174-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-141-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-179-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-180-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-181-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-182-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-183-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-184-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-185-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-186-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-190-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-152-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-222-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-193-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-194-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-221-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-196-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-220-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-218-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-217-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-204-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-216-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-215-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-213-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-139-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-209-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-210-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-211-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB

            • memory/2312-212-0x00007FFB55950000-0x00007FFB559BE000-memory.dmp

              Filesize

              440KB