Analysis

  • max time kernel
    24s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 19:36

General

  • Target

    applecleaner.exe

  • Size

    11KB

  • MD5

    22e3095c8cf11dc93358b7d9fc4a52ed

  • SHA1

    77f41d9876aa2eabb64260281f9ae469c7e2f7fc

  • SHA256

    6751c45698a1ebc492e3b1900d96c618ac0cd2a80ca56d3ba974fdfe43431ace

  • SHA512

    6e812c89510d83ee673a98228aff2922aa125fc609240640f1980103305b1108fed10993caa017c390bff00fa68e8be4295d50fcdb65a04e4ade7227eb200d56

  • SSDEEP

    192:5N8JZBfYtfqkDUedD8tUhKIziFcfqg9uldFwE9wtgH6:5NiBAtfqk9d4tOKJCHEmmH

Score
10/10

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\applecleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\applecleaner.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\tokyopear2457567.vbs" /f
        3⤵
        • Modifies registry class
        PID:4012
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
        3⤵
        • Modifies registry class
        PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C computerdefaults.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          computerdefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2256
          • C:\Windows\SysWOW64\wscript.exe
            "wscript.exe" C:\Users\Admin\AppData\Local\Temp\tokyopear2457567.vbs
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
              6⤵
                PID:4472
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AutoCADUpdateService_E5V2ENLNGzQsovpHQ050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\E5V2ENLNGzQsovpHQ050MX.exe" /RL HIGHEST /IT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC ONLOGON /TN AutoCADUpdateService_E5V2ENLNGzQsovpHQ050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\E5V2ENLNGzQsovpHQ050MX.exe" /RL HIGHEST /IT
            4⤵
            • Creates scheduled task(s)
            PID:1100
        • C:\Users\Admin\AppData\Local\Temp\gbseook1.exe
          "C:\Users\Admin\AppData\Local\Temp\gbseook1.exe" Taskmgr.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1868
        • C:\Users\Admin\AppData\Local\Temp\gbseook1.exe
          "C:\Users\Admin\AppData\Local\Temp\gbseook1.exe" explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4460
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3148

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

      Filesize

      1.4MB

      MD5

      6f2fdecc48e7d72ca1eb7f17a97e59ad

      SHA1

      fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

      SHA256

      70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

      SHA512

      fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

    • C:\Users\Admin\AppData\Local\Temp\gbseook1.exe

      Filesize

      124KB

      MD5

      e898826598a138f86f2aa80c0830707a

      SHA1

      1e912a5671f7786cc077f83146a0484e5a78729c

      SHA256

      df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

      SHA512

      6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

    • C:\Users\Admin\AppData\Local\Temp\tokyopear2457567.vbs

      Filesize

      171B

      MD5

      a34267102c21aff46aecc85598924544

      SHA1

      77268af47c6a4b9c6be7f7487b2c9b233d49d435

      SHA256

      eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

      SHA512

      5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

    • memory/2008-6-0x00000000059C0000-0x0000000005F64000-memory.dmp

      Filesize

      5.6MB

    • memory/2008-5-0x0000000005340000-0x00000000053D2000-memory.dmp

      Filesize

      584KB

    • memory/2008-4-0x0000000005400000-0x0000000005410000-memory.dmp

      Filesize

      64KB

    • memory/2008-0-0x0000000000620000-0x000000000062A000-memory.dmp

      Filesize

      40KB

    • memory/2008-3-0x0000000002D20000-0x0000000002D2A000-memory.dmp

      Filesize

      40KB

    • memory/2008-66-0x0000000005400000-0x0000000005410000-memory.dmp

      Filesize

      64KB

    • memory/2008-65-0x0000000007D70000-0x0000000007D82000-memory.dmp

      Filesize

      72KB

    • memory/2008-58-0x00000000748E0000-0x0000000075090000-memory.dmp

      Filesize

      7.7MB

    • memory/2008-2-0x0000000005260000-0x000000000527A000-memory.dmp

      Filesize

      104KB

    • memory/2008-1-0x00000000748E0000-0x0000000075090000-memory.dmp

      Filesize

      7.7MB

    • memory/2008-24-0x0000000011EC0000-0x0000000012B62000-memory.dmp

      Filesize

      12.6MB

    • memory/2008-21-0x000000000B120000-0x000000000BD20000-memory.dmp

      Filesize

      12.0MB

    • memory/3148-22-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-41-0x0000020684940000-0x0000020684948000-memory.dmp

      Filesize

      32KB

    • memory/3148-19-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-23-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-17-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-18-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-16-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-39-0x0000020684940000-0x0000020684948000-memory.dmp

      Filesize

      32KB

    • memory/3148-40-0x00000206850C0000-0x00000206850C1000-memory.dmp

      Filesize

      4KB

    • memory/3148-20-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-43-0x00007FF77AD30000-0x00007FF77AE60000-memory.dmp

      Filesize

      1.2MB

    • memory/3148-44-0x00007FFE823B0000-0x00007FFE82B40000-memory.dmp

      Filesize

      7.6MB

    • memory/3148-45-0x0000020684940000-0x0000020684948000-memory.dmp

      Filesize

      32KB

    • memory/3148-10-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-12-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3148-11-0x00000206857A0000-0x00000206857A1000-memory.dmp

      Filesize

      4KB

    • memory/3368-57-0x0000000002590000-0x0000000002598000-memory.dmp

      Filesize

      32KB

    • memory/3368-59-0x0000000002590000-0x0000000002598000-memory.dmp

      Filesize

      32KB

    • memory/3368-54-0x0000000002590000-0x0000000002598000-memory.dmp

      Filesize

      32KB