72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe
Size

868KB
MD5

02b01d2aa98f2e9e08e0ce4081d6bec7
SHA1

b60403e8adf1b076be504643b680f3eb6cbaa949
SHA256

72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1
SHA512

6fc3ebb34dd5d471c048a5692d01376c651cd3b55d7b2124923a6563b8a8797716d5e4e29f0bb0ede1bf1d8cc1389e20d55fd8048b6ae4d94e9b62df350b6053
SSDEEP

12288:cT8UCNLNCYAXYpkBsxbXnlkmHrnRlyOT5m56ZeCx:cTccAkWxbXfrnA56ZeCx

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Wine\WineFile	72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe

C:\Users\Admin\AppData\Local\Temp\72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe
"C:\Users\Admin\AppData\Local\Temp\72cd3a14860d821a73f05b702050bde457942563e46de55964e8dfc1a2ae4ec1.exe"
1⤵
- Identifies Wine through registry keys
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-0-0x00007FF6F9CF0000-0x00007FF6F9D9A000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads