d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6

Analysis

max time kernel
34s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe
Size

644KB
MD5

041f78dd12a1541802f909649ed638c0
SHA1

f32808798f13c303cc5de6cdc2e8411acb29c63f
SHA256

d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6
SHA512

12e342fbbe39f8a715ccbca95f7408db68291a91b484b6a48969d387524b205ea2fc0d2bf5203f30765406b439861156cc7f474ac5bf7cd0ebe3ed77a0f155d7
SSDEEP

12288:fergEKNuSWZZ+dFIYeFGPnOP2QpLHpBSZ1ejZnn+8iFPu+8S9:fOouSWZ8dzewPOP/pLH6Z1ejZnnHieS

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1508-55-0x0000000000400000-0x000000000056F000-memory.dmp	themida
behavioral1/memory/1508-59-0x0000000000400000-0x000000000056F000-memory.dmp	themida
behavioral1/memory/1508-60-0x0000000000400000-0x000000000056F000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1508	d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1508	d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1508	d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe

C:\Users\Admin\AppData\Local\Temp\d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe
"C:\Users\Admin\AppData\Local\Temp\d12c7e26fee1ef6d8045ad38b941abaf474a7054d3ee3ef028c099b6e0b597e6.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1508-55-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1508-56-0x0000000000BF0000-0x0000000000D5F000-memory.dmp

Filesize
1.4MB

Download
memory/1508-59-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1508-60-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download