1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd

Analysis

max time kernel
69s
max time network
65s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Target

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
Size

1.7MB
MD5

ffc7e1cbd754f867a530987beb84fcf1
SHA1

7a45e045758112ffea3f4bcf45698b36760632c9
SHA256

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd
SHA512

25fc10db7160e5b87f22eada2c0990fed0a9f0a400caad9c4570333effb3cd13c4c364da9a777ea2c2f712fbebe25f0931076f38cfd2214c9e7f60c44d6bcb64
SSDEEP

49152:4v6+n8PWJ6xvCcFCMmhO1HTjg+zjEZnww:A6+n8PlvTM2zjBjEZnww

Score

7^/10

evasion

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Wine	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe

C:\Users\Admin\AppData\Local\Temp\1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
"C:\Users\Admin\AppData\Local\Temp\1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe"
1⤵
- Identifies Wine through registry keys
PID:948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/948-54-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download
memory/948-55-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/948-56-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download