Analysis Overview
SHA256
abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45
Threat Level: Known bad
The file abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45 was found to be: Known bad.
Malicious Activity Summary
Joker family
UPX packed file
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2022-11-15 21:02
Signatures
Joker family
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-15 21:02
Reported
2022-11-15 21:05
Platform
win7-20220812-en
Max time kernel
90s
Max time network
110s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetWindowsHookEx
Processes
C:\Users\Admin\AppData\Local\Temp\abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45.exe
"C:\Users\Admin\AppData\Local\Temp\abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | soft-1251416406.file.myqcloud.com | udp |
| N/A | 8.8.8.8:53 | soft-1251416406.file.myqcloud.com | udp |
| N/A | 118.212.231.76:443 | soft-1251416406.file.myqcloud.com | tcp |
| N/A | 119.167.147.240:443 | soft-1251416406.file.myqcloud.com | tcp |
Files
memory/1096-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp
memory/1096-55-0x0000000010000000-0x0000000010018000-memory.dmp
memory/1096-56-0x0000000035D20000-0x0000000035D30000-memory.dmp
memory/1096-57-0x0000000010000000-0x0000000010018000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-11-15 21:02
Reported
2022-11-15 21:05
Platform
win10v2004-20221111-en
Max time kernel
97s
Max time network
100s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetWindowsHookEx
Processes
C:\Users\Admin\AppData\Local\Temp\abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45.exe
"C:\Users\Admin\AppData\Local\Temp\abb4e1099d2efc09bcbb2c2d0f68d2b6929054560d504f43621f2a67f066df45.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | soft-1251416406.file.myqcloud.com | udp |
| N/A | 119.167.147.240:443 | soft-1251416406.file.myqcloud.com | tcp |
| N/A | 119.167.147.240:443 | soft-1251416406.file.myqcloud.com | tcp |
| N/A | 8.8.8.8:53 | cdn1.mengyu555.com | udp |
| N/A | 42.193.15.167:7775 | cdn1.mengyu555.com | tcp |
| N/A | 51.105.71.136:443 | tcp | |
| N/A | 104.80.225.205:443 | tcp |
Files
memory/2296-132-0x0000000010000000-0x0000000010018000-memory.dmp
memory/2296-133-0x0000000036A40000-0x0000000036A50000-memory.dmp
memory/2296-134-0x0000000010000000-0x0000000010018000-memory.dmp