6889d60aff063453fc449ea663ee7f792f7b2c7f0b2b5834fd89fa1bbaf07c25

Analysis

max time kernel
36s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Target

comprovante_TED_pdf000203030302300302303203202302303203203203203203200230000.exe
Size

1.7MB
MD5

ffc7e1cbd754f867a530987beb84fcf1
SHA1

7a45e045758112ffea3f4bcf45698b36760632c9
SHA256

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd
SHA512

25fc10db7160e5b87f22eada2c0990fed0a9f0a400caad9c4570333effb3cd13c4c364da9a777ea2c2f712fbebe25f0931076f38cfd2214c9e7f60c44d6bcb64
SSDEEP

49152:4v6+n8PWJ6xvCcFCMmhO1HTjg+zjEZnww:A6+n8PlvTM2zjBjEZnww

Score

7^/10

evasion

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

comprovante_TED_pdf000203030302300302303203202302303203203203203203200230000.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine	comprovante_TED_pdf000203030302300302303203202302303203203203203203200230000.exe

C:\Users\Admin\AppData\Local\Temp\comprovante_TED_pdf000203030302300302303203202302303203203203203203200230000.exe
"C:\Users\Admin\AppData\Local\Temp\comprovante_TED_pdf000203030302300302303203202302303203203203203203200230000.exe"
1⤵
- Identifies Wine through registry keys
PID:784

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/784-54-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/784-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-56-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/784-57-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/784-58-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download