Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30-10-2022 15:37
General
-
Target
97065f6e95349a8d708967e98786d58a294240be5b245bac8c03e049e8a6957e.exe
-
Size
881KB
-
MD5
819cdb4ca01762e5911433e9089612c0
-
SHA1
52502551c3aa53489f5dc5b10008f6287201159c
-
SHA256
97065f6e95349a8d708967e98786d58a294240be5b245bac8c03e049e8a6957e
-
SHA512
55f6ccc14a6e0d2001dda6e748bed61f7a24efa66919a3cf122f20e27aaee3d6594084cc3c75accbdb5d1732b8b4112a390ce3ecc3ecddf6b47f15a1b12d3a03
-
SSDEEP
12288:t9NWCNX8CfYUW2SSPALm6KEj+YYiASpUQlzuQqiuOf5zpzoGxQNVb4Ky7Gd4LmrP:t9MCwX2Se6K5jSpFlaiu2hhx0pmLmnj
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97065f6e95349a8d708967e98786d58a294240be5b245bac8c03e049e8a6957e.exe"C:\Users\Admin\AppData\Local\Temp\97065f6e95349a8d708967e98786d58a294240be5b245bac8c03e049e8a6957e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.9MB
-
Filesize
1.6MB