d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
Size

5.2MB
MD5

241802511e5bc3e4df8825af7a0142fe
SHA1

3154b3023f959d78ee01d456ece4a5bfa1a0a25a
SHA256

d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83
SHA512

f5575bab52f6e26b18b76c46017a83c03a9538f88cce6266e0e99317253d9100bd60974cb77a17091302d40f7e33470aa9bec89da59f7754ddc0a403557e16cc
SSDEEP

98304:LjCntMEYbmlBSfxlsSjJTaoS8W4pZRFtIR9rGuLcIGW8Scof0/dluPG:HnLy8lvQ8WMZjtM9rGSfMGP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4276	AppleWorkshop.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SamsungElectronicsViewer = "C:\\ProgramData\\BiostarChecker\\AppleWorkshop.exe"	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
4276	AppleWorkshop.exe
4276	AppleWorkshop.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
4276	AppleWorkshop.exe
4276	AppleWorkshop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4276	4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe	84
PID 4032 wrote to memory of 4276	4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe	84
PID 4032 wrote to memory of 4276	4032	d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe	84

C:\Users\Admin\AppData\Local\Temp\d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe
"C:\Users\Admin\AppData\Local\Temp\d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032
- C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
241802511e5bc3e4df8825af7a0142fe

SHA1
3154b3023f959d78ee01d456ece4a5bfa1a0a25a

SHA256
d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83

SHA512
f5575bab52f6e26b18b76c46017a83c03a9538f88cce6266e0e99317253d9100bd60974cb77a17091302d40f7e33470aa9bec89da59f7754ddc0a403557e16cc

Download Submit
C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
241802511e5bc3e4df8825af7a0142fe

SHA1
3154b3023f959d78ee01d456ece4a5bfa1a0a25a

SHA256
d0ca84ffc4d59dd69feed998fa8d5af24212267694f90aeb6953e35d0d7f0f83

SHA512
f5575bab52f6e26b18b76c46017a83c03a9538f88cce6266e0e99317253d9100bd60974cb77a17091302d40f7e33470aa9bec89da59f7754ddc0a403557e16cc

Download Submit
memory/4032-133-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/4032-134-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download
memory/4276-139-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4276-140-0x0000000000400000-0x0000000000932000-memory.dmp

Filesize
5.2MB

Download