Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Cleaners/a...er.exe
windows7-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...rm.exe
windows7-x64
7Cleaners/a...rm.exe
windows10-2004-x64
7Cleaners/clean1.bat
windows7-x64
7Cleaners/clean1.bat
windows10-2004-x64
5Cleaners/clean2.bat
windows7-x64
7Cleaners/clean2.bat
windows10-2004-x64
4Cleaners/clean3.bat
windows7-x64
1Cleaners/clean3.bat
windows10-2004-x64
1Cleaners/clean4.bat
windows7-x64
1Cleaners/clean4.bat
windows10-2004-x64
1Cleaners/clean5.bat
windows7-x64
7Cleaners/clean5.bat
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:24
Behavioral task
behavioral1
Sample
Cleaners/applecleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Cleaners/applecperm.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Cleaners/applecperm.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Cleaners/clean1.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Cleaners/clean1.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Cleaners/clean2.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Cleaners/clean2.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Cleaners/clean3.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Cleaners/clean3.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Cleaners/clean4.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cleaners/clean4.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Cleaners/clean5.bat
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Cleaners/clean5.bat
Resource
win10v2004-20240709-en
General
-
Target
Cleaners/applecperm.exe
-
Size
14.3MB
-
MD5
9405b56af4d2bd0546ed27ed1d68b1ab
-
SHA1
8c7d5c8563f621c2cffafc9ccd4a156cfb7ec8f8
-
SHA256
6e997d7cdd07a8c173b569bedda6aaaf1b5ac10e5391a98c2f4593c5fc284b30
-
SHA512
96c6b04730ba00d6ba1bc6f90fa1e484594a39fd83b4c22a2b8646cfb1220c20cf5dc819e63ef3100ca66a3c302eb00b1d3b564e034d34b7995c20c9befc21d4
-
SSDEEP
393216:aiIE7YoPQMidQuslSq99oWOv+9fgEIlIQvew:D7rPQ3dQuSDorvSYEIpvf
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3008 applecperm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3008 2040 applecperm.exe 30 PID 2040 wrote to memory of 3008 2040 applecperm.exe 30 PID 2040 wrote to memory of 3008 2040 applecperm.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cleaners\applecperm.exe"C:\Users\Admin\AppData\Local\Temp\Cleaners\applecperm.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\Cleaners\applecperm.exe"C:\Users\Admin\AppData\Local\Temp\Cleaners\applecperm.exe"2⤵
- Loads dropped DLL
PID:3008
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989