Analysis

  • max time kernel
    82s
  • max time network
    83s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 20:10

General

  • Target

    applecleaner.exe

  • Size

    3.6MB

  • MD5

    f96eb2236970fb3ea97101b923af4228

  • SHA1

    e0eed80f1054acbf5389a7b8860a4503dd3e184a

  • SHA256

    46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

  • SHA512

    2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

  • SSDEEP

    98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\applecleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\applecleaner.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Checks system information in the registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im EpicGamesLauncher.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4588
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im FortniteClient-Win64-Shipping.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3340
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im Battle.net.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4448
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start https://applecheats.cc
      2⤵
        PID:4004
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
          3⤵
            PID:1272
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c pause
          2⤵
            PID:1672
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            2⤵
              PID:2372
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Windows\system32\netsh.exe
                NETSH WINSOCK RESET
                3⤵
                  PID:5024
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Windows\system32\netsh.exe
                  NETSH INT IP RESET
                  3⤵
                    PID:5004
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2536
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall reset
                    3⤵
                    • Modifies Windows Firewall
                    PID:2900
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2792
                  • C:\Windows\system32\netsh.exe
                    NETSH INTERFACE IPV4 RESET
                    3⤵
                      PID:3876
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1800
                    • C:\Windows\system32\netsh.exe
                      NETSH INTERFACE IPV6 RESET
                      3⤵
                        PID:1928
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3788
                      • C:\Windows\system32\netsh.exe
                        NETSH INTERFACE TCP RESET
                        3⤵
                          PID:4064
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4192
                        • C:\Windows\system32\netsh.exe
                          NETSH INT RESET ALL
                          3⤵
                            PID:4636
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4732
                          • C:\Windows\system32\ipconfig.exe
                            IPCONFIG /RELEASE
                            3⤵
                            • Gathers network information
                            PID:4580
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4296
                          • C:\Windows\system32\ipconfig.exe
                            IPCONFIG /RELEASE
                            3⤵
                            • Gathers network information
                            PID:3888
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4828
                          • C:\Windows\system32\ipconfig.exe
                            IPCONFIG /FLUSHDNS
                            3⤵
                            • Gathers network information
                            PID:2252
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:232
                          • C:\Windows\system32\nbtstat.exe
                            NBTSTAT -R
                            3⤵
                              PID:4656
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
                            2⤵
                              PID:2640
                              • C:\Windows\system32\nbtstat.exe
                                NBTSTAT -RR
                                3⤵
                                  PID:4960
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
                                2⤵
                                  PID:3796
                                  • C:\Windows\system32\ARP.EXE
                                    arp -a
                                    3⤵
                                      PID:4460
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
                                    2⤵
                                      PID:4344
                                      • C:\Windows\system32\ARP.EXE
                                        arp -d
                                        3⤵
                                          PID:5020
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
                                        2⤵
                                          PID:4116
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
                                            3⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4512
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1336,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
                                        1⤵
                                          PID:5004
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4880,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
                                          1⤵
                                            PID:1408
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=1340,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
                                            1⤵
                                              PID:4572
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5312,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
                                              1⤵
                                                PID:1852
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5452,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
                                                1⤵
                                                  PID:2152
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5456,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
                                                  1⤵
                                                    PID:4876

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/320-0-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-1-0x00007FFDF2590000-0x00007FFDF2592000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/320-4-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-3-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-2-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-5-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-6-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB

                                                  • memory/320-12-0x00007FF6E7650000-0x00007FF6E7FF2000-memory.dmp

                                                    Filesize

                                                    9.6MB