Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 18:50
Static task
static1
Behavioral task
behavioral1
Sample
cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe
Resource
win10v2004-20220901-en
General
-
Target
cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe
-
Size
140KB
-
MD5
0530e0b1f03b293aef48bad59e9aa04e
-
SHA1
8b374818e4ce75de81620e4d6ae85b90720eae8d
-
SHA256
cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6
-
SHA512
daceab921aa9f4122b0e22b089ff37284d8bbf1122cc05732dc7df7c4ad4de3bc92515499120379c867d3da8e858ca48d47c406315a1d2567eefd44b507d9b58
-
SSDEEP
1536:nnMg2OVLjlevyaRLBnLuRgiaUxRIxecePKH5nKLV+q:M0LpeTLlamiaUxRIxecePKQr
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Executes dropped EXE 1 IoCs
pid Process 4904 inl6D3.tmp -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3760 attrib.exe 4372 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cmd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995317" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2626305445" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2647086465" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu8888.site\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995317" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu8888.site IEXPLORE.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu8888.site\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995317" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu8888.site IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu8888.site\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2626305445" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C7A2537E-5F68-11ED-A0EE-DE60447A8195} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S" reg.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\winzip\\3.bat\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 4080 IEXPLORE.EXE 4080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 3464 wrote to memory of 1984 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 88 PID 3464 wrote to memory of 1984 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 88 PID 3464 wrote to memory of 1984 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 88 PID 1984 wrote to memory of 2112 1984 cmd.exe 90 PID 1984 wrote to memory of 2112 1984 cmd.exe 90 PID 1984 wrote to memory of 2112 1984 cmd.exe 90 PID 2112 wrote to memory of 2308 2112 cmd.exe 92 PID 2112 wrote to memory of 2308 2112 cmd.exe 92 PID 2112 wrote to memory of 5060 2112 cmd.exe 93 PID 2112 wrote to memory of 5060 2112 cmd.exe 93 PID 2112 wrote to memory of 5060 2112 cmd.exe 93 PID 2112 wrote to memory of 1588 2112 cmd.exe 94 PID 2112 wrote to memory of 1588 2112 cmd.exe 94 PID 2112 wrote to memory of 1588 2112 cmd.exe 94 PID 3464 wrote to memory of 4904 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 96 PID 3464 wrote to memory of 4904 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 96 PID 3464 wrote to memory of 4904 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 96 PID 1588 wrote to memory of 1012 1588 cmd.exe 97 PID 1588 wrote to memory of 1012 1588 cmd.exe 97 PID 1588 wrote to memory of 1012 1588 cmd.exe 97 PID 2308 wrote to memory of 4080 2308 iexplore.exe 98 PID 2308 wrote to memory of 4080 2308 iexplore.exe 98 PID 2308 wrote to memory of 4080 2308 iexplore.exe 98 PID 1588 wrote to memory of 3348 1588 cmd.exe 99 PID 1588 wrote to memory of 3348 1588 cmd.exe 99 PID 1588 wrote to memory of 3348 1588 cmd.exe 99 PID 1588 wrote to memory of 3716 1588 cmd.exe 100 PID 1588 wrote to memory of 3716 1588 cmd.exe 100 PID 1588 wrote to memory of 3716 1588 cmd.exe 100 PID 1588 wrote to memory of 952 1588 cmd.exe 101 PID 1588 wrote to memory of 952 1588 cmd.exe 101 PID 1588 wrote to memory of 952 1588 cmd.exe 101 PID 1588 wrote to memory of 4208 1588 cmd.exe 102 PID 1588 wrote to memory of 4208 1588 cmd.exe 102 PID 1588 wrote to memory of 4208 1588 cmd.exe 102 PID 1588 wrote to memory of 4372 1588 cmd.exe 103 PID 1588 wrote to memory of 4372 1588 cmd.exe 103 PID 1588 wrote to memory of 4372 1588 cmd.exe 103 PID 1588 wrote to memory of 3760 1588 cmd.exe 104 PID 1588 wrote to memory of 3760 1588 cmd.exe 104 PID 1588 wrote to memory of 3760 1588 cmd.exe 104 PID 1588 wrote to memory of 1504 1588 cmd.exe 105 PID 1588 wrote to memory of 1504 1588 cmd.exe 105 PID 1588 wrote to memory of 1504 1588 cmd.exe 105 PID 1588 wrote to memory of 3904 1588 cmd.exe 106 PID 1588 wrote to memory of 3904 1588 cmd.exe 106 PID 1588 wrote to memory of 3904 1588 cmd.exe 106 PID 1504 wrote to memory of 4396 1504 rundll32.exe 107 PID 1504 wrote to memory of 4396 1504 rundll32.exe 107 PID 1504 wrote to memory of 4396 1504 rundll32.exe 107 PID 4396 wrote to memory of 4076 4396 runonce.exe 108 PID 4396 wrote to memory of 4076 4396 runonce.exe 108 PID 4396 wrote to memory of 4076 4396 runonce.exe 108 PID 3464 wrote to memory of 4508 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 111 PID 3464 wrote to memory of 4508 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 111 PID 3464 wrote to memory of 4508 3464 cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe 111 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3760 attrib.exe 4372 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe"C:\Users\Admin\AppData\Local\Temp\cffe77cf0faff802b48c8dfcda7ae6bdef09e1a514a0d64a43113ec02b47dde6.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_min_bat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?821334⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4080
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\1.inf4⤵PID:5060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\winzip\2.bat4⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1012
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:3348
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f5⤵PID:3716
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:952
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\winzip\3.bat""" /f5⤵
- Modifies registry class
PID:4208
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4372
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\winzip\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3760
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\winzip\2.inf5⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:4076
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:3904
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\inl6D3.tmpC:\Users\Admin\AppData\Local\Temp\inl6D3.tmp2⤵
- Executes dropped EXE
PID:4904
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFFE77~1.EXE > nul2⤵PID:4508
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD580f22efce2b9390a36eea98657b6d1f4
SHA1150d40f67639fccd130d8616ddc0cf623b491905
SHA256227fafbbbd678543e247cfdbf8b5ff60e8fc576da70c2a3f0f735cab2652dd2d
SHA512e2dc713b48477f7c98c0a0d42306745133476876805b4861ba1d76b11f3e9067fc83f3bc6ea350c1298f54dd3ff3ec00e0cb08fff5618df7d0f723900b93ddf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD53e45fa32f27197fcd7eb8c82af167fe0
SHA13d20a7298d6c2e3f00d77d556d0e8dbfa164ed64
SHA2564ea9b0816d5c296378513ded5b291f4bc61c9948f0eb9ebb2fd1c7d26cbc810c
SHA5124f02300c54fcc7704f60425a7d425297444bec8bab78849bf17809951c51e32f891d9ecb33622c01a8e23db2a8de1d914ae2dff104fac2ecc9e6ddd0404f54ba
-
Filesize
1KB
MD53facc60dceffd752f284e286f4ceeb8a
SHA1667ffb98ff425eeb8e3c4c85e0b9fee75cf76da4
SHA256a0583d0e827c3e2aabdfb4e99d6ce78e06eac265bd85f339559433571853f56d
SHA51226c16fd7d173aca60695d464035f639affbb0dcc74788b9246fa051a2bdcfa886e162014ff0eca751fcb90c84a17ab77bacfda1442249f4cbe6bb334c06ce317
-
Filesize
57.2MB
MD553110ea408fd1251ab1ed76ddbf2a7fe
SHA16b3c3d8b56cb6ac156b13cfdcefee2a670b50e7d
SHA256a6182cb9b31e4bf08cdd2e6f9c44e18a9ab05505033d89e3478372be213ab26c
SHA5122822cd2ad0f4267e2219cf29230252e6d329820f34b19dca5ab7b3e9fbf08020e3d923b3203cfd5486534958229051824acd5b095ac6a240954d17bfd24832e2
-
Filesize
57.2MB
MD553110ea408fd1251ab1ed76ddbf2a7fe
SHA16b3c3d8b56cb6ac156b13cfdcefee2a670b50e7d
SHA256a6182cb9b31e4bf08cdd2e6f9c44e18a9ab05505033d89e3478372be213ab26c
SHA5122822cd2ad0f4267e2219cf29230252e6d329820f34b19dca5ab7b3e9fbf08020e3d923b3203cfd5486534958229051824acd5b095ac6a240954d17bfd24832e2
-
Filesize
53B
MD59b41ad553fc0a87c014049dfede9e7fa
SHA1840b9c356ec59e65d33bae61c439b0abf11663bd
SHA256a4bd6b14aa9694ba74db5503576072036cd232d586b5e3dd3fe3dade84a67b5e
SHA5126de134478cd5052675cf936f3dc92fb823d72fc3d44c66f5d0755691481302f63cfe602dd7b492354487c9c5b692a09a404c1081265bb3676030cb43a64369b8
-
Filesize
2KB
MD568a30985a8b4a1dae5b24721ca5b8269
SHA178481107bbddcf18ffc4d25a184ec74274241a6b
SHA256fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf
SHA512d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24
-
Filesize
410B
MD566a1f0147fed7ddd19e9bb7ff93705c5
SHA19d803c81ea2195617379b880b227892ba30b0bf6
SHA2564f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764
SHA512cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597
-
Filesize
3KB
MD5c106ffc420b54a4f0fd331f10657dc66
SHA18930d5b56358f518bdf5ccca2b4d24f98ce7a03f
SHA256fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b
SHA512ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd
-
Filesize
247B
MD5bf915cb73f6126d712c727039ad3d5e6
SHA173ff72a83711c90e45f8bd34505b3284fd2a870b
SHA2563fd8eeaededa0a76d36df51803c01fe328ba110702a625b28c25bc83f6ef5940
SHA512752387b92716e8e5296d24c532f16e17a955c8f02055c9fd66d4ff84c8f140d7f2a43cfbb4ff97bd5ba1eebc7fa0c215a9283a180a9598b1b413730d19db1957
-
Filesize
44KB
MD5ab958bc3496d297fabbed059a5b34b02
SHA1fbcb3f166bee109266afa46ab14a344c05d92678
SHA256826762620265ac6c9bb44ff6ae2ac4fbb886f2d74119bf21a1ddc107c0dbf8e3
SHA512fb52954ddba092af2ae7be07860bbd0346e843592e29476be4f5b1c8ca522cc2baa8dab937d8b38940f96c2924043bf604c7026f89ff630d6b4dbe61c42eaed4