Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2023, 16:12

General

  • Target

    Winner.pw/Winner_Free.exe

  • Size

    5.6MB

  • MD5

    a8133b3fdf3ec104c0f0d503ef6a7ec7

  • SHA1

    d875876bd027a59b9157a45df00a24ccd505ed20

  • SHA256

    c3429972cc6d611fa4f940f89624658e3aadc85a681bdcd5adce9bdc6c6d3072

  • SHA512

    2734304de246490ff8d3ab0487838afc6cc2abb7cfbc0404860cbb395ba69887c33b802a08d32f8ccd2c6e341e4b5062c3aa27b3de2f4bba3c542d984e4721b1

  • SSDEEP

    98304:dV6s5YTnGUIcNAYDtYsvs6zqVXoQW07XlOVZ+dHXn8RXHhxBh7ZM5DBO:dV6s5XUxNAotvsjoQhLGQHuXrEB

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Winner.pw\Winner_Free.exe
    "C:\Users\Admin\AppData\Local\Temp\Winner.pw\Winner_Free.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c title Jsxgemz61zaYMnGj5NY0maQ5Ai32D701D5pSppl7a7zs0SI5Ec758r1rTa55
      2⤵
        PID:2856

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

            Filesize

            1KB

            MD5

            a266bb7dcc38a562631361bbf61dd11b

            SHA1

            3b1efd3a66ea28b16697394703a72ca340a05bd5

            SHA256

            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

            SHA512

            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            fa36cf89cb58ba6e99f27b992ae74e99

            SHA1

            a1050ff895ea07e0efd652b82ae8969e25a828b8

            SHA256

            991fcbfbfe4d6556a38992f4e0e28ffd39de5d6678347eb2f1c8ec8bbc0cff24

            SHA512

            29307a06562567432c0d22bee509979f903def4301401e0cc7cf11682d6b376c02b781c45f2a8b9c0a5bb4f58c8d6b6b9a85a64396dd3e67156155fa32ffa629

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

            Filesize

            242B

            MD5

            95e87ab95f81e699d140594a0b9fb1d1

            SHA1

            b28513f7479c187ac945a07e391b2022ad7e3756

            SHA256

            9f42805dbd3a25c65769eaec62925c60f456a300887a43f23f4dff0d27d833ba

            SHA512

            5b9cb34d1a529cd0adc20315859c8ed762e8c71d820ebaa98b04ce5568d02fe0e89ff8a3bbe5b93179417d05eb7eabf1bba80360a06259604383066c5b0fc108

          • C:\Users\Admin\AppData\Local\Temp\Tar239C.tmp

            Filesize

            171KB

            MD5

            9c0c641c06238516f27941aa1166d427

            SHA1

            64cd549fb8cf014fcd9312aa7a5b023847b6c977

            SHA256

            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

            SHA512

            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          • memory/2960-5-0x0000000000F70000-0x0000000001871000-memory.dmp

            Filesize

            9.0MB

          • memory/2960-8-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2960-13-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2960-11-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2960-9-0x0000000077D90000-0x0000000077D91000-memory.dmp

            Filesize

            4KB

          • memory/2960-7-0x0000000000140000-0x0000000000141000-memory.dmp

            Filesize

            4KB

          • memory/2960-0-0x0000000000F70000-0x0000000001871000-memory.dmp

            Filesize

            9.0MB

          • memory/2960-3-0x0000000000140000-0x0000000000141000-memory.dmp

            Filesize

            4KB

          • memory/2960-1-0x0000000000140000-0x0000000000141000-memory.dmp

            Filesize

            4KB

          • memory/2960-121-0x0000000000F70000-0x0000000001871000-memory.dmp

            Filesize

            9.0MB