cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19

Analysis

max time kernel
150s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe
Size

1.2MB
MD5

22fde0753062a2e7921d59fe64d6f7cc
SHA1

c6f1d83d64cfa541ea907d527bc79c698d337643
SHA256

cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19
SHA512

a1e024571711dab2ca9eb33f9b8371eb277cd1b708668c6b7c87ed41beec640151f2b1f775b640ec8139b598c4b298fe5bae2d2b4253142fe7fdec3f2e2aaf04
SSDEEP

24576:LDFq/8wVCMozowl4as1Y+zijEJq95/T+f8hDZ9VMMwsR+jlL79VJoLwl/Q:LDFq/8KC1TUY+ziwq9ty0hDHVqJjB9Q/

Score

7^/10

evasion trojan

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Wine	cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe

C:\Users\Admin\AppData\Local\Temp\cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe
"C:\Users\Admin\AppData\Local\Temp\cd8fdc43e7b00d9bd34d4f6fb477e66968b302692e8ccf040e6f180620ac5c19.exe"
1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-132-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/1608-133-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download