Overview
overview
3Static
static
1jokescript-main.zip
windows10-2004-x64
1jokescript...ICENSE
windows10-2004-x64
1jokescript...DME.md
windows10-2004-x64
3jokescript...av.xml
windows10-2004-x64
1jokescript...x.html
windows10-2004-x64
1jokescript...on.png
windows10-2004-x64
3jokescript...n.html
windows10-2004-x64
1jokescript...in.png
windows10-2004-x64
3jokescript...av.xml
windows10-2004-x64
1jokescript...7.html
windows10-2004-x64
1jokescript...2.html
windows10-2004-x64
1jokescript...e.html
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 07:05
Static task
static1
Behavioral task
behavioral1
Sample
jokescript-main.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
jokescript-main/LICENSE
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
jokescript-main/README.md
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/fav.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/garticflix.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/icon.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/main.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/main.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/garticflix/unfav.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/redbot-v1.7.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/redbotv2.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
jokescript-main/ygn-redbot-whowhere-garticflix/whowhere.html
Resource
win10v2004-20230221-en
General
-
Target
jokescript-main/README.md
-
Size
148B
-
MD5
fd0914ee454d401927cc75769fa6f396
-
SHA1
9569d9cc730a00fb23450d86f792c1405214e8b4
-
SHA256
cd11025eefd6cfd8e1d2807f55381e3361c2e2ecc40532808506f5d2577e416e
-
SHA512
feeb2a5d42ca296268b48da2d4ec8b64141bf26baf285fff2af3de06ff1ce5a51b802ec65dbb803836d53ce309e74133ad1a2c03636d8a4defef7d15c9fbc969
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4832 OpenWith.exe