89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d

Analysis

max time kernel
56s
max time network
82s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe
Size

1.0MB
MD5

7ab8dc2aaa460eeb24615e84710cdef6
SHA1

24c8456954d56b9753376a667335d03cf44fe679
SHA256

89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d
SHA512

6732ae26727e2fcae792492302370d23c12c9fe68fbbc0766fd3d42b8b58a7f89486da445abd2c9c57a0b945fc8e6ec23a993ae4ee7ec7a064ae8c2422394dea
SSDEEP

24576:LkFQOFfwl9Le1bahoTH3LMvVMSxCzAOYTpXutkPPjvbN1r8N:LkF5OGbsW3gMSxCzautibf

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1380-54-0x0000000000400000-0x0000000000642000-memory.dmp	themida
behavioral1/memory/1380-56-0x0000000000400000-0x0000000000642000-memory.dmp	themida
behavioral1/memory/1380-57-0x0000000000400000-0x0000000000642000-memory.dmp	themida

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1380	89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1380	89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe

C:\Users\Admin\AppData\Local\Temp\89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe
"C:\Users\Admin\AppData\Local\Temp\89d6e77aac2240e52d9f62d9a217c999486b6f43c9376b06a42b461de507438d.exe"
1⤵
- Identifies Wine through registry keys
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-54-0x0000000000400000-0x0000000000642000-memory.dmp

Filesize
2.3MB

Download
memory/1380-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000000400000-0x0000000000642000-memory.dmp

Filesize
2.3MB

Download
memory/1380-57-0x0000000000400000-0x0000000000642000-memory.dmp

Filesize
2.3MB

Download