6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe
Size

615KB
MD5

3f6b75eb8fb937eb581a803df146c8d1
SHA1

6821beb7883f9b53a7d7950bf3f82183e01d7823
SHA256

6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005
SHA512

4da9cc3c9e25981933687e728940d9036cd9178215a6b2d968656de2fc653dbcca9d70cd603f7055ebec5cb234d4f7702181531968d423bb47747a64beaac248
SSDEEP

12288:dpGjhAf0ecumN16FWjM7kfHq0Ceb1efCpvy9TSV7NYUFwC:dpGCf0xwFEMF071tK27OUB

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine	6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1652-54-0x0000000000400000-0x0000000000561000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1652	6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1652	6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe

C:\Users\Admin\AppData\Local\Temp\6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe
"C:\Users\Admin\AppData\Local\Temp\6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download