d474389e232291dbd215bebce0a0fd5dc4b0b07267f62242064d5ddf68437b8f

General

Target

d5cde7f22f7935faa7b0e8018602a1cc.exe
Size

106KB
MD5

d5cde7f22f7935faa7b0e8018602a1cc
SHA1

9e5957a95bf94ec351a20dad852a2109c3a0584e
SHA256

d474389e232291dbd215bebce0a0fd5dc4b0b07267f62242064d5ddf68437b8f
SHA512

66efcef18591b0444e2d91d64c8e3b3e72465e70c3ab536e648e96817e594eeae5d6fcf8e21f85df55c2aa5c7aabc6fd60c94b2bc0537095d1a51bcc17cc68f5
SSDEEP

3072:m/SfPt12nzNjgqH6LerIIiw6q6EpaGN256l2Ohy:maf1KRjgqH8erdiw6q62256lNhy

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	d5cde7f22f7935faa7b0e8018602a1cc.exe

Executes dropped EXE 3 IoCs

pid	Process
3144	bf99.exe
2856	jokycard.exe
2860	iexplore¡¡.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mssysint = "iexplore¡¡.exe"	jokycard.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iexplore¡¡.exe	iexplore¡¡.exe
File created	C:\Windows\SysWOW64\iexplore¡¡.exe	jokycard.exe
File opened for modification	C:\Windows\SysWOW64\iexplore¡¡.exe	jokycard.exe
File created	C:\Windows\SysWOW64\psinthk.dll	jokycard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
376	4348	WerFault.exe	93

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2856	jokycard.exe
2856	jokycard.exe
3144	bf99.exe
2860	iexplore¡¡.exe
2860	iexplore¡¡.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3144	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	100
PID 4348 wrote to memory of 3144	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	100
PID 4348 wrote to memory of 3144	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	100
PID 4348 wrote to memory of 2856	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	101
PID 4348 wrote to memory of 2856	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	101
PID 4348 wrote to memory of 2856	4348	d5cde7f22f7935faa7b0e8018602a1cc.exe	101
PID 2856 wrote to memory of 2860	2856	jokycard.exe	102
PID 2856 wrote to memory of 2860	2856	jokycard.exe	102
PID 2856 wrote to memory of 2860	2856	jokycard.exe	102

C:\Users\Admin\AppData\Local\Temp\d5cde7f22f7935faa7b0e8018602a1cc.exe
"C:\Users\Admin\AppData\Local\Temp\d5cde7f22f7935faa7b0e8018602a1cc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 424
  2⤵
  - Program crash
  PID:376
- C:\Users\Admin\AppData\Local\Temp\bf99.exe
  "C:\Users\Admin\AppData\Local\Temp\bf99.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\jokycard.exe
  "C:\Users\Admin\AppData\Local\Temp\jokycard.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\iexplore¡¡.exe
    C:\Windows\system32\iexplore¡¡.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bf99.exe

Filesize
36KB

MD5
d2eca3a9c459f95d4b756764b1493abd

SHA1
77b689a424375237e71a20db0c225a3decacdda8

SHA256
a144309f375c79cb4e6f97b8140a6cf78bac40fabeea5ade91fcc8515c37d2a8

SHA512
326ec541cb44107c51a4512191c8256834d88b5089a909de30e263dec7dc87cad0c5db4694d6e3ac74e2bc21f78d9aa1f89688c8fe8858636c4d949e61672bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\jokycard.exe

Filesize
55KB

MD5
7c04bae78202b1827a7aaa2854da4fd8

SHA1
a699eafc9fab7025ad58f8bc8d50cd371abad3a2

SHA256
03638028470a97ace3cd645bdc03db2c087979dde6b97b5e9f921514db9b5155

SHA512
a94bfa7aaf4b11901a08e15c319b7c2cf203ab3f59796f99dac6f0f7714cdf6b1fec3908c525796e2bf93c97f8e61f3d7d7de4d2ea407c36f3f3466d5dce36a1

Download Submit
memory/2856-21-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2856-33-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2860-32-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4348-22-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads