2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984

Analysis

max time kernel
118s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
Size

5.2MB
MD5

5b343eff2c2d3a234a556ae1a6013fc3
SHA1

7f91a883075ec59205e902241802c669e15ccc1c
SHA256

2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984
SHA512

2b113e05e9929fa3bcc92f007728c152b93df652214bc1780fee3b8e0fbba1a4c1f9fb06e94ad6543cbdbebafd1b04481c852cdfdf55eb1d8950aab7bc6e3531
SSDEEP

98304:yhT6QVPpkoELL5iCMwVua+TMvWJWpondTX08dToybCLj:8PpWjTUwuJv1jRO

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1148	AppleWorkshop.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SamsungElectronicsViewer = "C:\\ProgramData\\BiostarChecker\\AppleWorkshop.exe"	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
1148	AppleWorkshop.exe
1148	AppleWorkshop.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
1148	AppleWorkshop.exe
1148	AppleWorkshop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1148	4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe	85
PID 4700 wrote to memory of 1148	4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe	85
PID 4700 wrote to memory of 1148	4700	2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe	85

C:\Users\Admin\AppData\Local\Temp\2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe
"C:\Users\Admin\AppData\Local\Temp\2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4700
- C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  C:\ProgramData\BiostarChecker\AppleWorkshop.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
5b343eff2c2d3a234a556ae1a6013fc3

SHA1
7f91a883075ec59205e902241802c669e15ccc1c

SHA256
2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984

SHA512
2b113e05e9929fa3bcc92f007728c152b93df652214bc1780fee3b8e0fbba1a4c1f9fb06e94ad6543cbdbebafd1b04481c852cdfdf55eb1d8950aab7bc6e3531

Download Submit
C:\ProgramData\BiostarChecker\AppleWorkshop.exe

Filesize
5.2MB

MD5
5b343eff2c2d3a234a556ae1a6013fc3

SHA1
7f91a883075ec59205e902241802c669e15ccc1c

SHA256
2c939d03547321dc4448a642138ae3e41485c51ff8a98c09c551b1714cbff984

SHA512
2b113e05e9929fa3bcc92f007728c152b93df652214bc1780fee3b8e0fbba1a4c1f9fb06e94ad6543cbdbebafd1b04481c852cdfdf55eb1d8950aab7bc6e3531

Download Submit
memory/1148-139-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1148-140-0x0000000000400000-0x000000000093D000-memory.dmp

Filesize
5.2MB

Download
memory/4700-133-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/4700-134-0x0000000000400000-0x000000000093D000-memory.dmp

Filesize
5.2MB

Download