Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 18:50

General

  • Target

    cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe

  • Size

    140KB

  • MD5

    0530e0b1f03b293aef48bad59e9aa04e

  • SHA1

    8b374818e4ce75de81620e4d6ae85b90720eae8d

  • SHA256

    cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6

  • SHA512

    daceab921aa9f4122b0e22b089ff37284d8bbf1122cc05732dc7df7c4ad4de3bc92515499120379c867d3da8e858ca48d47c406315a1d2567eefd44b507d9b58

  • SSDEEP

    1536:nnMg2OVLjlevyaRLBnLuRgiaUxRIxecePKH5nKLV+q:M0LpeTLlamiaUxRIxecePKQr

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe
    "C:\Users\Admin\AppData\Local\Temp\cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4080
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf
          4⤵
            PID:5060
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat
            4⤵
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:1588
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:1012
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:3348
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
              5⤵
                PID:3716
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:952
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:4208
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:4372
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:3760
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf
                5⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:1504
                • C:\Windows\SysWOW64\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:4396
                  • C:\Windows\SysWOW64\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    7⤵
                      PID:4076
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 D:\VolumeDH\inj.dat,MainLoad
                  5⤵
                    PID:3904
            • C:\Users\Admin\AppData\Local\Temp\inl6D3.tmp
              C:\Users\Admin\AppData\Local\Temp\inl6D3.tmp
              2⤵
              • Executes dropped EXE
              PID:4904
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFFE77~1.EXE > nul
              2⤵
                PID:4508

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              80f22efce2b9390a36eea98657b6d1f4

              SHA1

              150d40f67639fccd130d8616ddc0cf623b491905

              SHA256

              227fafbbbd678543e247cfdbf8b5ff60e8fc576da70c2a3f0f735cab2652dd2d

              SHA512

              e2dc713b48477f7c98c0a0d42306745133476876805b4861ba1d76b11f3e9067fc83f3bc6ea350c1298f54dd3ff3ec00e0cb08fff5618df7d0f723900b93ddf4

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              434B

              MD5

              3e45fa32f27197fcd7eb8c82af167fe0

              SHA1

              3d20a7298d6c2e3f00d77d556d0e8dbfa164ed64

              SHA256

              4ea9b0816d5c296378513ded5b291f4bc61c9948f0eb9ebb2fd1c7d26cbc810c

              SHA512

              4f02300c54fcc7704f60425a7d425297444bec8bab78849bf17809951c51e32f891d9ecb33622c01a8e23db2a8de1d914ae2dff104fac2ecc9e6ddd0404f54ba

            • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

              Filesize

              1KB

              MD5

              3facc60dceffd752f284e286f4ceeb8a

              SHA1

              667ffb98ff425eeb8e3c4c85e0b9fee75cf76da4

              SHA256

              a0583d0e827c3e2aabdfb4e99d6ce78e06eac265bd85f339559433571853f56d

              SHA512

              26c16fd7d173aca60695d464035f639affbb0dcc74788b9246fa051a2bdcfa886e162014ff0eca751fcb90c84a17ab77bacfda1442249f4cbe6bb334c06ce317

            • C:\Users\Admin\AppData\Local\Temp\inl6D3.tmp

              Filesize

              57.2MB

              MD5

              53110ea408fd1251ab1ed76ddbf2a7fe

              SHA1

              6b3c3d8b56cb6ac156b13cfdcefee2a670b50e7d

              SHA256

              a6182cb9b31e4bf08cdd2e6f9c44e18a9ab05505033d89e3478372be213ab26c

              SHA512

              2822cd2ad0f4267e2219cf29230252e6d329820f34b19dca5ab7b3e9fbf08020e3d923b3203cfd5486534958229051824acd5b095ac6a240954d17bfd24832e2

            • C:\Users\Admin\AppData\Local\Temp\inl6D3.tmp

              Filesize

              57.2MB

              MD5

              53110ea408fd1251ab1ed76ddbf2a7fe

              SHA1

              6b3c3d8b56cb6ac156b13cfdcefee2a670b50e7d

              SHA256

              a6182cb9b31e4bf08cdd2e6f9c44e18a9ab05505033d89e3478372be213ab26c

              SHA512

              2822cd2ad0f4267e2219cf29230252e6d329820f34b19dca5ab7b3e9fbf08020e3d923b3203cfd5486534958229051824acd5b095ac6a240954d17bfd24832e2

            • C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat

              Filesize

              53B

              MD5

              9b41ad553fc0a87c014049dfede9e7fa

              SHA1

              840b9c356ec59e65d33bae61c439b0abf11663bd

              SHA256

              a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e

              SHA512

              6de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8

            • C:\Users\Admin\AppData\Roaming\winzip\1.bat

              Filesize

              2KB

              MD5

              68a30985a8b4a1dae5b24721ca5b8269

              SHA1

              78481107bbddcf18ffc4d25a184ec74274241a6b

              SHA256

              fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf

              SHA512

              d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24

            • C:\Users\Admin\AppData\Roaming\winzip\1.inf

              Filesize

              410B

              MD5

              66a1f0147fed7ddd19e9bb7ff93705c5

              SHA1

              9d803c81ea2195617379b880b227892ba30b0bf6

              SHA256

              4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

              SHA512

              cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

            • C:\Users\Admin\AppData\Roaming\winzip\2.bat

              Filesize

              3KB

              MD5

              c106ffc420b54a4f0fd331f10657dc66

              SHA1

              8930d5b56358f518bdf5ccca2b4d24f98ce7a03f

              SHA256

              fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b

              SHA512

              ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd

            • C:\Users\Admin\AppData\Roaming\winzip\2.inf

              Filesize

              247B

              MD5

              bf915cb73f6126d712c727039ad3d5e6

              SHA1

              73ff72a83711c90e45f8bd34505b3284fd2a870b

              SHA256

              3fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940

              SHA512

              752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957

            • C:\Users\Admin\AppData\Roaming\winzip\4.bat

              Filesize

              44KB

              MD5

              ab958bc3496d297fabbed059a5b34b02

              SHA1

              fbcb3f166bee109266afa46ab14a344c05d92678

              SHA256

              826762620265ac6c9bb44ff6ae2ac4fbb886f2d74119bf21a1ddc107c0dbf8e3

              SHA512

              fb52954ddba092af2ae7be07860bbd0346e843592e29476be4f5b1c8ca522cc2baa8dab937d8b38940f96c2924043bf604c7026f89ff630d6b4dbe61c42eaed4

            • memory/2308-176-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-145-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-152-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-154-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-150-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-156-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-157-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-159-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-162-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-164-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-149-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-148-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-168-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-167-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-147-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-169-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-146-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-221-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-175-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-172-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-220-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-178-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-177-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-180-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-179-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-215-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-182-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-183-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-151-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-142-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-186-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-214-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-191-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-212-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-192-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-211-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-196-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-141-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-210-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-209-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-208-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-200-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-201-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/2308-207-0x00007FF862F80000-0x00007FF862FEE000-memory.dmp

              Filesize

              440KB

            • memory/3464-133-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB

            • memory/3464-227-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB

            • memory/3464-132-0x0000000000400000-0x0000000000423000-memory.dmp

              Filesize

              140KB