1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd

General

Target

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
Size

1.7MB
MD5

ffc7e1cbd754f867a530987beb84fcf1
SHA1

7a45e045758112ffea3f4bcf45698b36760632c9
SHA256

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd
SHA512

25fc10db7160e5b87f22eada2c0990fed0a9f0a400caad9c4570333effb3cd13c4c364da9a777ea2c2f712fbebe25f0931076f38cfd2214c9e7f60c44d6bcb64
SSDEEP

49152:4v6+n8PWJ6xvCcFCMmhO1HTjg+zjEZnww:A6+n8PlvTM2zjBjEZnww

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Wine	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe

Program crash 25 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3480	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
1992	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
2968	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4836	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3056	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3892	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
5060	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
1364	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3660	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4656	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4948	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4880	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4924	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
1468	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4912	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3228	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4376	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
524	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
1376	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
5000	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
2720	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3572	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
4752	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
3288	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
360	1112	WerFault.exe	1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe

C:\Users\Admin\AppData\Local\Temp\1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe
"C:\Users\Admin\AppData\Local\Temp\1c489a087257082c9617bb00d183a17595796d295b664b6862c6e921a2e249cd.exe"
1⤵
- Identifies Wine through registry keys
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 276
2⤵
- Program crash
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 400
2⤵
- Program crash
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 484
2⤵
- Program crash
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 492
2⤵
- Program crash
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 524
2⤵
- Program crash
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 532
2⤵
- Program crash
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 560
2⤵
- Program crash
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 532
2⤵
- Program crash
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 564
2⤵
- Program crash
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 572
2⤵
- Program crash
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 536
2⤵
- Program crash
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 548
2⤵
- Program crash
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 552
2⤵
- Program crash
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 524
2⤵
- Program crash
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 568
2⤵
- Program crash
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 520
2⤵
- Program crash
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 588
2⤵
- Program crash
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 496
2⤵
- Program crash
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 500
2⤵
- Program crash
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 544
2⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 484
2⤵
- Program crash
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 492
2⤵
- Program crash
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 496
2⤵
- Program crash
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 500
2⤵
- Program crash
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 512
2⤵
- Program crash
PID:360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1112 -ip 1112
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1112 -ip 1112
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1112 -ip 1112
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1112 -ip 1112
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1112 -ip 1112
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1112 -ip 1112
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1112 -ip 1112
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1112 -ip 1112
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1112 -ip 1112
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1112 -ip 1112
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1112 -ip 1112
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1112 -ip 1112
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1112 -ip 1112
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1112 -ip 1112
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1112 -ip 1112
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1112 -ip 1112
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1112 -ip 1112
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1112 -ip 1112
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1112 -ip 1112
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1112 -ip 1112
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1112 -ip 1112
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1112 -ip 1112
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1112 -ip 1112
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1112 -ip 1112
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1112 -ip 1112
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-132-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/1112-133-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/1112-134-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/1112-135-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads