Overview
overview
10Static
static
7cleaners.zip
windows7-x64
1cleaners.zip
windows7-x64
1Spoofer.exe
windows10-1703-x64
1Spoofer.exe
windows7-x64
1cleaners/a...er.exe
windows10-2004-x64
9cleaners/a...er.exe
windows7-x64
9cleaners/cleaner.bat
windows10-1703-x64
10cleaners/cleaner.bat
windows7-x64
10spoofers/C...32.exe
windows10-1703-x64
1spoofers/C...32.exe
windows7-x64
1spoofers/C...64.exe
windows10-1703-x64
1spoofers/C...64.exe
windows7-x64
1spoofers/C...64.sys
windows10-2004-x64
1spoofers/C...64.sys
windows7-x64
1spoofers/g...64.sys
windows10-2004-x64
1spoofers/g...64.sys
windows7-x64
1spoofers/s...er.bat
windows10-2004-x64
1spoofers/s...er.bat
windows7-x64
1Resubmissions
10-07-2024 02:30
240710-czl2gstcke 1020-06-2024 12:39
240620-pvzs1axflf 1020-06-2024 12:36
240620-pswcss1hrr 720-06-2024 12:35
240620-psqgjs1hrm 1020-06-2024 12:33
240620-prd25axdpg 10Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 02:30
Behavioral task
behavioral1
Sample
cleaners.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cleaners.zip
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
Spoofer.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Spoofer.exe
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
cleaners/applecleaner.exe
Resource
win7-20240704-en
Behavioral task
behavioral7
Sample
cleaners/cleaner.bat
Resource
win10-20240611-en
Behavioral task
behavioral8
Sample
cleaners/cleaner.bat
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
spoofers/CupFixerx32.exe
Resource
win10-20240611-en
Behavioral task
behavioral10
Sample
spoofers/CupFixerx32.exe
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
spoofers/CupFixerx64.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
spoofers/CupFixerx64.exe
Resource
win7-20240708-en
Behavioral task
behavioral13
Sample
spoofers/CupFixerx64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
spoofers/CupFixerx64.sys
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
spoofers/gsoftgmx64.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
spoofers/gsoftgmx64.sys
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
spoofers/serial_checker.bat
Resource
win10v2004-20240704-en
Behavioral task
behavioral18
Sample
spoofers/serial_checker.bat
Resource
win7-20240708-en
General
-
Target
cleaners/applecleaner.exe
-
Size
3.6MB
-
MD5
f96eb2236970fb3ea97101b923af4228
-
SHA1
e0eed80f1054acbf5389a7b8860a4503dd3e184a
-
SHA256
46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172
-
SHA512
2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7
-
SSDEEP
98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ applecleaner.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion applecleaner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion applecleaner.exe -
resource yara_rule behavioral6/memory/3024-0-0x000000013FAD0000-0x0000000140472000-memory.dmp themida behavioral6/memory/3024-2-0x000000013FAD0000-0x0000000140472000-memory.dmp themida behavioral6/memory/3024-3-0x000000013FAD0000-0x0000000140472000-memory.dmp themida behavioral6/memory/3024-5-0x000000013FAD0000-0x0000000140472000-memory.dmp themida behavioral6/memory/3024-4-0x000000013FAD0000-0x0000000140472000-memory.dmp themida behavioral6/memory/3024-6-0x000000013FAD0000-0x0000000140472000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA applecleaner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3024 applecleaner.exe -
Kills process with taskkill 3 IoCs
pid Process 2860 taskkill.exe 2236 taskkill.exe 2724 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2236 taskkill.exe Token: SeDebugPrivilege 2724 taskkill.exe Token: SeDebugPrivilege 2860 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2176 3024 applecleaner.exe 31 PID 3024 wrote to memory of 2176 3024 applecleaner.exe 31 PID 3024 wrote to memory of 2176 3024 applecleaner.exe 31 PID 2176 wrote to memory of 2236 2176 cmd.exe 32 PID 2176 wrote to memory of 2236 2176 cmd.exe 32 PID 2176 wrote to memory of 2236 2176 cmd.exe 32 PID 3024 wrote to memory of 2904 3024 applecleaner.exe 34 PID 3024 wrote to memory of 2904 3024 applecleaner.exe 34 PID 3024 wrote to memory of 2904 3024 applecleaner.exe 34 PID 2904 wrote to memory of 2724 2904 cmd.exe 35 PID 2904 wrote to memory of 2724 2904 cmd.exe 35 PID 2904 wrote to memory of 2724 2904 cmd.exe 35 PID 3024 wrote to memory of 2708 3024 applecleaner.exe 36 PID 3024 wrote to memory of 2708 3024 applecleaner.exe 36 PID 3024 wrote to memory of 2708 3024 applecleaner.exe 36 PID 2708 wrote to memory of 2860 2708 cmd.exe 37 PID 2708 wrote to memory of 2860 2708 cmd.exe 37 PID 2708 wrote to memory of 2860 2708 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe"C:\Users\Admin\AppData\Local\Temp\cleaners\applecleaner.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\taskkill.exetaskkill /f /im EpicGamesLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\taskkill.exetaskkill /f /im Battle.net.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-