1a62ed192ff4a7bd746fa24c8d7cd96578a4c7e9f0d4a6651a2a3d0baff9c433

Resubmissions

25/04/2024, 18:27

240425-w3zljade29 9

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AppleCleaner.exe
Size

3.6MB
MD5

da2176757b2fead6539243b42057cb3c
SHA1

e14195bd4066e90c821caabd6ca63a173c1ca802
SHA256

1a62ed192ff4a7bd746fa24c8d7cd96578a4c7e9f0d4a6651a2a3d0baff9c433
SHA512

b9d13ecd8679064bc4cd9dbd823ba5367aebe13177c9ed5e6c6c40d70823ed32977bd40cde73ccfaa49f6f32b19b4f06f9396beb145bd774891d4290873c735d
SSDEEP

98304:gmQu0iNucsADierKQYRc4sNHOZjKg5tkdv+HR5+a:fQabDieOQ944HOZjp5tkx+x3

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AppleCleaner.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "24461"	AppleCleaner.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2780	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AppleCleaner.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2120-0-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-2-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-3-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-4-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-5-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-6-0x000000013F920000-0x00000001402C3000-memory.dmp	themida
behavioral1/memory/2120-621-0x000000013F920000-0x00000001402C3000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AppleCleaner.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	iexplore.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	AppleCleaner.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6QIBR00Y\desktop.ini	AppleCleaner.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\87XXOISN\desktop.ini	AppleCleaner.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	AppleCleaner.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HKGE1S7K\desktop.ini	AppleCleaner.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JSZQNXMR\desktop.ini	AppleCleaner.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer = "DADY"	AppleCleaner.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2120	AppleCleaner.exe

Enumerates system info in registry 2 TTPs 19 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "DADY"	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion = "pc-q35-0.P"	AppleCleaner.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "fa3b2bb3-fc24821b-f"	AppleCleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	AppleCleaner.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "f99c87c1-959f0454-1"	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	AppleCleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	AppleCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AppleCleaner.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1532	ipconfig.exe
3068	ipconfig.exe
2224	ipconfig.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2644	taskkill.exe
2660	taskkill.exe
2584	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Migration\IE Installed Date = b6f276705db73932	AppleCleaner.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 50cf4b423e97da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LinksBar\MarketingLinksMigrate = b088e6423e97da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FC8BEB1-0331-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\User Preferences\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b9cda7b9de4e453d0b8f73275b52f8c2e609fd1d2dbf6edd672e0cbea9c51e81000000000e800000000200002000000064709eaf6d11864edfe540ea8dff04a180ac7f75ccfcd90af72e0e54159356e4100000007b5ddc03eaa83035f3f542470b16d8e740000000c3e56a1b074e209db972e3374b529e23cb863f54394beb325f6aaf9b236d00bc8833894cbb03413af6dc699372844b3fa219d2892180a41813682ff6844c0e49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Setup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = 5027e4423e97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LinksBar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b040e0453e97da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002836c453da5faad6489c6ac3260fb8bdfb0d48fa1f59caa32da372c1f7c94c0f000000000e800000000200002000000025d18e471ce1aef9de02843be3645efcb0d3fd42217f119aaf46fe09f6f0ef6750000000b74339c53343da006f7cc38a3cac95e4b9dc78c6807e365ea31af2b09ae642c7680355ce4153e32dc09d3de894cc2164509d2d4e0c624ff3cf89c8d76e0d36e452fced9a090ebb27315689a978679b1640000000c0c847a9bf4191576d99d7835722580ea88b9b2e581316b48d8407749344e81139203972dcbd6f5f6d7e125afcd8dd37994005ec72fa7f6ac2837c13b0e4d33e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 5027e4423e97da01	iexplore.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2140	WMIC.exe
Token: SeSecurityPrivilege	2140	WMIC.exe
Token: SeTakeOwnershipPrivilege	2140	WMIC.exe
Token: SeLoadDriverPrivilege	2140	WMIC.exe
Token: SeSystemProfilePrivilege	2140	WMIC.exe
Token: SeSystemtimePrivilege	2140	WMIC.exe
Token: SeProfSingleProcessPrivilege	2140	WMIC.exe
Token: SeIncBasePriorityPrivilege	2140	WMIC.exe
Token: SeCreatePagefilePrivilege	2140	WMIC.exe
Token: SeBackupPrivilege	2140	WMIC.exe
Token: SeRestorePrivilege	2140	WMIC.exe
Token: SeShutdownPrivilege	2140	WMIC.exe
Token: SeDebugPrivilege	2140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2140	WMIC.exe
Token: SeRemoteShutdownPrivilege	2140	WMIC.exe
Token: SeUndockPrivilege	2140	WMIC.exe
Token: SeManageVolumePrivilege	2140	WMIC.exe
Token: 33	2140	WMIC.exe
Token: 34	2140	WMIC.exe
Token: 35	2140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2140	WMIC.exe
Token: SeSecurityPrivilege	2140	WMIC.exe
Token: SeTakeOwnershipPrivilege	2140	WMIC.exe
Token: SeLoadDriverPrivilege	2140	WMIC.exe
Token: SeSystemProfilePrivilege	2140	WMIC.exe
Token: SeSystemtimePrivilege	2140	WMIC.exe
Token: SeProfSingleProcessPrivilege	2140	WMIC.exe
Token: SeIncBasePriorityPrivilege	2140	WMIC.exe
Token: SeCreatePagefilePrivilege	2140	WMIC.exe
Token: SeBackupPrivilege	2140	WMIC.exe
Token: SeRestorePrivilege	2140	WMIC.exe
Token: SeShutdownPrivilege	2140	WMIC.exe
Token: SeDebugPrivilege	2140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2140	WMIC.exe
Token: SeRemoteShutdownPrivilege	2140	WMIC.exe
Token: SeUndockPrivilege	2140	WMIC.exe
Token: SeManageVolumePrivilege	2140	WMIC.exe
Token: 33	2140	WMIC.exe
Token: 34	2140	WMIC.exe
Token: 35	2140	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2204	2120	AppleCleaner.exe	29
PID 2120 wrote to memory of 2204	2120	AppleCleaner.exe	29
PID 2120 wrote to memory of 2204	2120	AppleCleaner.exe	29
PID 2204 wrote to memory of 2644	2204	cmd.exe	30
PID 2204 wrote to memory of 2644	2204	cmd.exe	30
PID 2204 wrote to memory of 2644	2204	cmd.exe	30
PID 2120 wrote to memory of 2700	2120	AppleCleaner.exe	32
PID 2120 wrote to memory of 2700	2120	AppleCleaner.exe	32
PID 2120 wrote to memory of 2700	2120	AppleCleaner.exe	32
PID 2700 wrote to memory of 2660	2700	cmd.exe	33
PID 2700 wrote to memory of 2660	2700	cmd.exe	33
PID 2700 wrote to memory of 2660	2700	cmd.exe	33
PID 2120 wrote to memory of 3004	2120	AppleCleaner.exe	34
PID 2120 wrote to memory of 3004	2120	AppleCleaner.exe	34
PID 2120 wrote to memory of 3004	2120	AppleCleaner.exe	34
PID 3004 wrote to memory of 2584	3004	cmd.exe	35
PID 3004 wrote to memory of 2584	3004	cmd.exe	35
PID 3004 wrote to memory of 2584	3004	cmd.exe	35
PID 2120 wrote to memory of 2728	2120	AppleCleaner.exe	36
PID 2120 wrote to memory of 2728	2120	AppleCleaner.exe	36
PID 2120 wrote to memory of 2728	2120	AppleCleaner.exe	36
PID 2728 wrote to memory of 2208	2728	cmd.exe	37
PID 2728 wrote to memory of 2208	2728	cmd.exe	37
PID 2728 wrote to memory of 2208	2728	cmd.exe	37
PID 2208 wrote to memory of 2912	2208	iexplore.exe	38
PID 2208 wrote to memory of 2912	2208	iexplore.exe	38
PID 2208 wrote to memory of 2912	2208	iexplore.exe	38
PID 2208 wrote to memory of 2912	2208	iexplore.exe	38
PID 2120 wrote to memory of 2724	2120	AppleCleaner.exe	40
PID 2120 wrote to memory of 2724	2120	AppleCleaner.exe	40
PID 2120 wrote to memory of 2724	2120	AppleCleaner.exe	40
PID 2120 wrote to memory of 2488	2120	AppleCleaner.exe	41
PID 2120 wrote to memory of 2488	2120	AppleCleaner.exe	41
PID 2120 wrote to memory of 2488	2120	AppleCleaner.exe	41
PID 2488 wrote to memory of 2732	2488	cmd.exe	42
PID 2488 wrote to memory of 2732	2488	cmd.exe	42
PID 2488 wrote to memory of 2732	2488	cmd.exe	42
PID 2120 wrote to memory of 2460	2120	AppleCleaner.exe	43
PID 2120 wrote to memory of 2460	2120	AppleCleaner.exe	43
PID 2120 wrote to memory of 2460	2120	AppleCleaner.exe	43
PID 2460 wrote to memory of 2624	2460	cmd.exe	44
PID 2460 wrote to memory of 2624	2460	cmd.exe	44
PID 2460 wrote to memory of 2624	2460	cmd.exe	44
PID 2120 wrote to memory of 2632	2120	AppleCleaner.exe	45
PID 2120 wrote to memory of 2632	2120	AppleCleaner.exe	45
PID 2120 wrote to memory of 2632	2120	AppleCleaner.exe	45
PID 2632 wrote to memory of 2780	2632	cmd.exe	46
PID 2632 wrote to memory of 2780	2632	cmd.exe	46
PID 2632 wrote to memory of 2780	2632	cmd.exe	46
PID 2120 wrote to memory of 2776	2120	AppleCleaner.exe	47
PID 2120 wrote to memory of 2776	2120	AppleCleaner.exe	47
PID 2120 wrote to memory of 2776	2120	AppleCleaner.exe	47
PID 2776 wrote to memory of 2192	2776	cmd.exe	48
PID 2776 wrote to memory of 2192	2776	cmd.exe	48
PID 2776 wrote to memory of 2192	2776	cmd.exe	48
PID 2120 wrote to memory of 1712	2120	AppleCleaner.exe	49
PID 2120 wrote to memory of 1712	2120	AppleCleaner.exe	49
PID 2120 wrote to memory of 1712	2120	AppleCleaner.exe	49
PID 1712 wrote to memory of 320	1712	cmd.exe	50
PID 1712 wrote to memory of 320	1712	cmd.exe	50
PID 1712 wrote to memory of 320	1712	cmd.exe	50
PID 2120 wrote to memory of 1716	2120	AppleCleaner.exe	51
PID 2120 wrote to memory of 1716	2120	AppleCleaner.exe	51
PID 2120 wrote to memory of 1716	2120	AppleCleaner.exe	51

C:\Users\Admin\AppData\Local\Temp\AppleCleaner.exe
"C:\Users\Admin\AppData\Local\Temp\AppleCleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Manipulates Digital Signatures
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://applecheats.cc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://applecheats.cc/
    3⤵
    - Drops desktop.ini file(s)
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\netsh.exe
    NETSH WINSOCK RESET
    3⤵
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\netsh.exe
    NETSH INT IP RESET
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV4 RESET
    3⤵
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV6 RESET
    3⤵
    PID:320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
  2⤵
  PID:1716
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE TCP RESET
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
  2⤵
  PID:1760
- - C:\Windows\system32\netsh.exe
    NETSH INT RESET ALL
    3⤵
    PID:788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:784
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:1956
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
  2⤵
  PID:816
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /FLUSHDNS
    3⤵
    - Gathers network information
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
  2⤵
  PID:2216
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -R
    3⤵
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
  2⤵
  PID:1644
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -RR
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
  2⤵
  PID:2416
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
  2⤵
  PID:1576
- - C:\Windows\system32\ARP.EXE
    arp -d
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
  2⤵
  PID:1972
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c92ad18063a9c345c3bfdbf0f6e47cbf

SHA1
f2bef1a40724f32a9c1812300a56a0999498b598

SHA256
9dec33fd7617cd564d85725eec6470aae4fcb1251fa3dee8fa8a61b243b1584c

SHA512
a32c85f34e6068f03bb5409a375973a956af86b56cdd8812a616cc713c6b26c0416a9f891dd040b0c8aaf2a297232fce4c0db3149d9e3d9f7e003e237e73d4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fabcde2252036dba727f0bdf0bfb70f9

SHA1
db8dc0af6cac13d4af3e60eaf69082d5d0357374

SHA256
87b2eb41679f115074041b3f4ec2047dbbc304a3322ce0354a90556f53d2419d

SHA512
21208a1b3d68529c42afa5ba74adf7275d00f64eb7588bc5bec0ff1be64327aa7be3c57bc90e7702ca0d848a4bb8fa56f2fe9607c62e63c7b1ced1c39d764887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8e1e95a3d7a32266a1f444cb2926ac9

SHA1
965aba6ab2e72afc7e6437e0e22ce92b2047ce01

SHA256
8d34fd559906ac9ad42fd277df0a9d0374d7da4e76a9c5f7fe0ddc1ec4c508e4

SHA512
d1c6c09b37ec82d5a1e2d5f4090f49e9f40bfaf91dd96ad1d951399281eb59d43a2fec5aa644829a008589714ae8943ba87665ac530935e1dc1aa031a95160ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65cf332efadffc4c7d759c60c73796bc

SHA1
b259e5b29ae5379d79de836ac57f5ad5401b4d66

SHA256
65fcdf34595e5f79dcdf7623f307e3465f69b30f62d4d936724f6c411d0ddeb3

SHA512
9070c2958c44ab5dc30dbfa213824c041d7d827b9b2847b790736be8f06795bf376527c559ae7f6dbd99939c34874344aa502103c3dd7776dfe2bbd4e83e1430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
226cc3f8ac296ae3084e72079997e688

SHA1
35d124ded840d95bb06ffe0d56e71f7a1f2f7710

SHA256
8d5722279c386d0355039ba1782530a356d9a1f3562863da9dbc5d5b76e25784

SHA512
a191adf47674010c5b37e1b3748478e3830defe068262d97012c1e877e4ea9eb6724f5e94b997c331f6eaf308a5523d30394687e91849427245648f7e1ad4489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f97d1349b6807b7de02164f0c80fe74

SHA1
d47743a6ed45dcd57b3194e5fa127c422a2f5075

SHA256
f2878bdb329658500f0e1e30f8af5e1263f92b49d31b2e0fd105b317f313ac1b

SHA512
f1711357f544993a91972142d3195bda136a4d3d6ee4fc12deb2cfc8f5e599c6b6f564bc9f247c7ce087acbff869a3c12fe1e3792645b09c780ccd433e0b7aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a2299cbba947c685ee7ee23a112e2fe

SHA1
e1e67e133fa89a5619c1cc87a1c19f503e1ebc96

SHA256
011afcc5ba1edcae7d11f36a337aebfa18a4fcb92c75c3310a8c3ad4765c52b7

SHA512
66694e5ed8c62220d0dbc1745592bacc6ee5b0b4fbc1689fe622541a6d669938d3d51d5d5ef947574d1153bab75222957d64eb892c2b0968d1023b9cc1ede4d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3453ea964085f371e6327f7ccff5fcc0

SHA1
d949ddd09829dacf4e681ad2eaca482825ba6415

SHA256
f562d0a62f6cc56a8ba1e91d9e5f65b8dcc1f6f1b681db88d6f89dec666d882e

SHA512
3f0643f92f866e899fc26b5a31c15e083d38aa777d3b095d3c2401032856c458acbf423d9a7d27ff5e9069108c084a3a9bd69df17f888bff903029238863533d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcdd20b11ff4b3fb2719910b9af2943b

SHA1
9caedf5a14519d3af29e2420939cf9ff21a6d9f1

SHA256
342db70d61e3e17f93c6feb6c08be24514ec3e516cdebb4272e53d7d72d77262

SHA512
d72fe02fee3788482b71185ac40fdf48cdd69f2c5e1cad5d2eb6f7c9260b6819e5aa603ae2e141099de1d37c1b9680ae0b1b8343eea8e20d5460f3fd93a4f5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546beb23c46eed070d734767b0113e7b

SHA1
89b1faf5e9e6e1f67f06d9afc7ba2648262a6714

SHA256
7f70bbe7eb5582baff1154a9b15381f8a8d5b798e802b1955ffdb4a4b12db93a

SHA512
41b02735797c34504d87671cb8d822a2ae7008a121cd271583c733bd6be4dc2b7d55cd91dab6c791f4391bae8cef67384c1568611a3ded1dc1d0dbd19166e57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
671292af77b6d50edc8f1fbbed5afc9b

SHA1
8e38bf4d9ff844c3eec23d0cbdb353ca627b7e7e

SHA256
2bfd430759cfe6e1376d40c6df5ac9f6c90926bb64711f10740af67b4b92040a

SHA512
e07f9ec0f232850ac9e67874f162268db617ecfa60aea93e3d85861e485dec3ef63fe0961f811595728048a772d60f09401c21f05f42f6558d68d04654656301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
46c4c40d87f261631ffdb0d150e5b18d

SHA1
6b64de1997326120eed5b959b7ec7a2ffc6d5cd2

SHA256
a8c375bbd6911ea9b3edb60b070c452902312247af79f7086479b6df2518f335

SHA512
361c44d16bebef21f7dc6cb98fbf31c3a3ea8dd3c24e8385ee83e21f185a456196b310fc83f8950374ab878f92df66b52d6522a2f0c3d1444e1cb58ef22fcd5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32E9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2120-0-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-6-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-5-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-4-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-3-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-2-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download
memory/2120-1-0x0000000077640000-0x00000000777E9000-memory.dmp

Filesize
1.7MB

Download
memory/2120-621-0x000000013F920000-0x00000001402C3000-memory.dmp

Filesize
9.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads