Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 09:11

General

  • Target

    d683a53753fd240f10ba549d716efad4eac0e7888d0f2005825d2a1e33ae766f.exe

  • Size

    1.4MB

  • MD5

    06766c6b7cbb756db14010fb822ace01

  • SHA1

    229bc192b55248d31c46e059fa12d9304c9e36ed

  • SHA256

    d683a53753fd240f10ba549d716efad4eac0e7888d0f2005825d2a1e33ae766f

  • SHA512

    1bb6f9c6ed23830e556b556e1d3e17cc8284443ac99913a027febc81ad9c271e7ef56770d8cfbb96a5232cfe51639763aa63b902a1e5ac83fbfdea6814565e48

  • SSDEEP

    24576:2usQqSvM171SMKs64y8GJL1Uc16NV7UwyXK8IHTR3fUs9SUIzZTh4Z1R8sCMBWi:IMMPe8Ex2Y1qfUssVThW16hMB

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d683a53753fd240f10ba549d716efad4eac0e7888d0f2005825d2a1e33ae766f.exe
    "C:\Users\Admin\AppData\Local\Temp\d683a53753fd240f10ba549d716efad4eac0e7888d0f2005825d2a1e33ae766f.exe"
    1⤵
    • Identifies Wine through registry keys
    PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/544-132-0x0000000000400000-0x000000000065E000-memory.dmp
    Filesize

    2.4MB