3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d

Analysis

max time kernel
112s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:33

Target

3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d.exe
Size

174KB
MD5

8f4595cedd010fb745a439d30baf835b
SHA1

dbdb258b2e4d93e393b53fca626bb737c9b73dd6
SHA256

3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d
SHA512

190bfcd5ca52adf5ceba374e16f91766eecbededcff679255beb130d748be4166a950cd1607e0f802704e68b50aa3f8e7b0387aee25a6e60a7548d0e412ac309
SSDEEP

768:UBn1vlL+5IDCxFcJcFAkd3zZydTiDY20Su3p686W0yNy8alL7OJ/w/p:UF19L+5IDmcJE3EZN3s86W0yNyLvy

Score

7^/10

evasion

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\WINE	3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d.exe

C:\Users\Admin\AppData\Local\Temp\3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d.exe
"C:\Users\Admin\AppData\Local\Temp\3ad54772a121d1f92a8bd083197969e1f3bb4b8bed126a1ae0c6e20a9240519d.exe"
1⤵
- Identifies Wine through registry keys
PID:4872

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4872-132-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download