05fe1601534d962e745acf8c0c577a2dbf87be8e62ea6672be043605d5906716

General

Target
vmzeus_3.3.1.0.vir.exe
Size 300KB
Sample200719-axbdp6nzd2
SHA256 05fe1601534d962e745acf8c0c577a2dbf87be8e62ea6672be043605d5906716
MD5 c780cfbc40a338933120ec9efd6d6a0a
SHA1 63025be073538fbe61af35e70ae22918bfc172e5
SHA512 c35f2cd5be20fa9f82e24cb852d0d10a63df4e5f4aad09456c5fe28b5f5bde432939b1b998201c8bbfbe36d40fe42da2a25517bdc4716eca782a3887d2ec7d4b
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2016	vmzeus_3.3.1.0.vir.exe
2792	trayMicrosoft.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2016 wrote to memory of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2152 wrote to memory of 2792	2152	vmzeus_3.3.1.0.vir.exe	71
PID 2152 wrote to memory of 2792	2152	vmzeus_3.3.1.0.vir.exe	71
PID 2152 wrote to memory of 2792	2152	vmzeus_3.3.1.0.vir.exe	71
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2792 wrote to memory of 3940	2792	trayMicrosoft.exe	72
PID 2152 wrote to memory of 2556	2152	vmzeus_3.3.1.0.vir.exe	73
PID 2152 wrote to memory of 2556	2152	vmzeus_3.3.1.0.vir.exe	73
PID 2152 wrote to memory of 2556	2152	vmzeus_3.3.1.0.vir.exe	73

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2152	2016	vmzeus_3.3.1.0.vir.exe	68
PID 2792 set thread context of 3940	2792	trayMicrosoft.exe	72

Executes dropped EXE 2 IoCs

pid	Process
2792	trayMicrosoft.exe
3940	trayMicrosoft.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3940	trayMicrosoft.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	vmzeus_3.3.1.0.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	trayMicrosoft.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\Currentversion\Run	trayMicrosoft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D3D2488E-FDB6-81E0-9838-3AE5F8187D7D} = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\trayMicrosoft.exe"	trayMicrosoft.exe