613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe
Size

824KB
MD5

ed43fdf053dbf8135a3aebcce6e3aed5
SHA1

044f5d25b5b50463e55db0e42659b67c6cf00f98
SHA256

613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5
SHA512

d3ad217134daa45d090d7960e6d72cf8ee8aca0af8b8b08e96d5fe36eef83b4f44a4527a6c6c2af4c34407e08668eeeab675ed3c1ba34aedc3ee0f8070f6d3d6
SSDEEP

12288:1owN3u10J02aN7qNxwf7R2bjw4LOTRJHJNs4Q5PmOArn9X4zO:1oy3q0J87kAoM42HJNhQFmOArnP

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Wine	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Wine	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe
Key opened	\REGISTRY\MACHINE\Software\Wine	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1908	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1908	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe
1908	613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe

C:\Users\Admin\AppData\Local\Temp\613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe
"C:\Users\Admin\AppData\Local\Temp\613ec645ea3aa2fd611c763edf15706114291e1a4a09756b6a298597c02ce7c5.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-1-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-2-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-3-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-5-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-9-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/1908-13-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download