13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
Size

5.2MB
MD5

7d3fd8921051aee53ab4769c899d8adb
SHA1

f671b26684ca48ce674b2a2812b3f72936cf237a
SHA256

13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638
SHA512

554681fb8c2f5e8a8f14ee817d496d0236e28e99a53135263b7793c2bd8a691c5ca1f38d2ec941b96f505abaa3d375c91f22ea454be5413c7b237311d0d971a5
SSDEEP

98304:jb3ja3nofR3hgsTjFyCA87sHAUzewh/SyEK6Xu+8rSKCe3ixd8ObHo9BWdcmL:PImhfs87sXSW6Xu+1e3ixFb4B3mL

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4956	AppleWorkshop.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SamsungElectronicsViewer = "C:\\ProgramData\\BiostarChecker\\AppleWorkshop.exe"	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
4956	AppleWorkshop.exe
4956	AppleWorkshop.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
4956	AppleWorkshop.exe
4956	AppleWorkshop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4956	5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe	82
PID 5084 wrote to memory of 4956	5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe	82
PID 5084 wrote to memory of 4956	5084	13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe	82

C:\Users\Admin\AppData\Local\Temp\13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe
"C:\Users\Admin\AppData\Local\Temp\13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084
- C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
7d3fd8921051aee53ab4769c899d8adb

SHA1
f671b26684ca48ce674b2a2812b3f72936cf237a

SHA256
13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638

SHA512
554681fb8c2f5e8a8f14ee817d496d0236e28e99a53135263b7793c2bd8a691c5ca1f38d2ec941b96f505abaa3d375c91f22ea454be5413c7b237311d0d971a5

Download Submit
C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
7d3fd8921051aee53ab4769c899d8adb

SHA1
f671b26684ca48ce674b2a2812b3f72936cf237a

SHA256
13cdb69d7f1d3924863e9c02783eebace0df4351825f756e479365bfff10e638

SHA512
554681fb8c2f5e8a8f14ee817d496d0236e28e99a53135263b7793c2bd8a691c5ca1f38d2ec941b96f505abaa3d375c91f22ea454be5413c7b237311d0d971a5

Download Submit
memory/4956-139-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/4956-140-0x0000000000400000-0x0000000000935000-memory.dmp

Filesize
5.2MB

Download
memory/5084-133-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/5084-134-0x0000000000400000-0x0000000000935000-memory.dmp

Filesize
5.2MB

Download