Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
11/11/2023, 13:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe
Resource
win7-20231020-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe
-
Size
700KB
-
MD5
4c88feae28d201c72e4d73708b02ff97
-
SHA1
1a037cecbb9e5656bcba9752111a1e08a6b54826
-
SHA256
0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df
-
SHA512
f8272cf5a61beec88c1a27ff6216984b989e44baa468ab5a268e4ddd284c4a76b877eea8d65a988ef8696f424473edc574b7163354ce3e1e66e1fa1b1d78f281
-
SSDEEP
6144:FOiKYOX5snnKCoypi060fhiZ0bpEwoCWvLP3g1nqFCssQpJH3C7FJ7zZ:aYOXen4PozbfhWvLP3g1nYCbt
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Wine\TaskManager 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe 2924 0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe"C:\Users\Admin\AppData\Local\Temp\0e7bc8dd2fa729dec0456d6f4107cec67868ccd2a8b17426cd33adef1cf791df.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924