Analysis
-
max time kernel
322s -
max time network
338s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 07:08
General
-
Target
31a07bf0ca57bd130420f5e09401f65bed376ecfcdc1214e100ddf9f7d0d9f3a.exe
-
Size
1.6MB
-
MD5
53a549bf76e7b15e4fa37e15a92bb549
-
SHA1
a68c57f41d851463113c949554fb30a0e4e4503b
-
SHA256
31a07bf0ca57bd130420f5e09401f65bed376ecfcdc1214e100ddf9f7d0d9f3a
-
SHA512
970464a71a8a9a8d3288cadb35e93625b06e9bb22648c672042a1365705621d749eae0c0f6994ae835b5d77abdbac09d3099fc790d82cc2101bb7c7423518b7f
-
SSDEEP
24576:ug6CdmhLCQkvIhAu7njTI2w4VTP+ncFqogkDMqLfCy9qI3sDNpq1omyx2QrVQijT:b6CEceBWcFxzfCy9qI3zor9
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a07bf0ca57bd130420f5e09401f65bed376ecfcdc1214e100ddf9f7d0d9f3a.exe"C:\Users\Admin\AppData\Local\Temp\31a07bf0ca57bd130420f5e09401f65bed376ecfcdc1214e100ddf9f7d0d9f3a.exe"1⤵
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB