7b6d799270931ac8653e17960b95378a67c532cc4c9ea485e4f3430a58089f97

Analysis

max time kernel
66s
max time network
121s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vmzeus_3.2.8.1.vir.exe
Size

265KB
MD5

0422542c1ff6ffbffeeef1737344b3da
SHA1

9594c25b3df6a2e417a8ffa693474284829aade0
SHA256

7b6d799270931ac8653e17960b95378a67c532cc4c9ea485e4f3430a58089f97
SHA512

de1d04bee6c2bacfb09da13732a10daa03a6003e060ff7ce8dd61ad809a96caa33d9bb96bd3b6b4bcb919385ba4764670af9edf58ede21f69643dc8a3d61b6ea

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

vmzeus_3.2.8.1.vir.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE vmzeus_3.2.8.1.vir.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vmzeus_3.2.8.1.vir.exe

pid process

3100 vmzeus_3.2.8.1.vir.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE	vmzeus_3.2.8.1.vir.exe

pid	process
3100	vmzeus_3.2.8.1.vir.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vmzeus_3.2.8.1.vir.exe

description	pid	process	target process
PID 3100 wrote to memory of 3832	3100	vmzeus_3.2.8.1.vir.exe	cmd.exe
PID 3100 wrote to memory of 3832	3100	vmzeus_3.2.8.1.vir.exe	cmd.exe
PID 3100 wrote to memory of 3832	3100	vmzeus_3.2.8.1.vir.exe	cmd.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3956 3100 WerFault.exe vmzeus_3.2.8.1.vir.exe
1812 3100 WerFault.exe vmzeus_3.2.8.1.vir.exe

pid	pid_target	process	target process
3956	3100	WerFault.exe	vmzeus_3.2.8.1.vir.exe
1812	3100	WerFault.exe	vmzeus_3.2.8.1.vir.exe

C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.8.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\vmzeus_3.2.8.1.vir.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp7778fed1.bat"
2⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 792
2⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 784
2⤵
- Program crash
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7778fed1.bat

Download Submit
memory/3832-0-0x0000000000000000-mapping.dmp

Download