Analysis
-
max time kernel
65s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
1d22cf354d01fb6e8e820e4ae126a179.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d22cf354d01fb6e8e820e4ae126a179.exe
Resource
win10v2004-20231215-en
General
-
Target
1d22cf354d01fb6e8e820e4ae126a179.exe
-
Size
435KB
-
MD5
1d22cf354d01fb6e8e820e4ae126a179
-
SHA1
b9f9e70cdbbadacff82663824c4b5495b7ca0bce
-
SHA256
b963d469e902918fdb3a1bd9ddf7043616d6e4829a8a1fba9f6d22fe42e96cd6
-
SHA512
ccd27d09d6857e1b7f7885570bc84d2d03f7ca5bbd1bb45ce5c9d27bc7b34d48092e3c9fc7b240fe66b9cc3adfea282432e60f6857b7b1908f8d6fc61b6f30b0
-
SSDEEP
12288:66rKCp7wMWa6950dH/SxzPoHLDeHbekM:d17wMWc1SxMrm1
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2848 autostart.exe 2964 autostart.exe 1532 autostart.exe 1200 autostart.exe 1944 autostart.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine 1d22cf354d01fb6e8e820e4ae126a179.exe Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine autostart.exe Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine autostart.exe Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine autostart.exe Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine autostart.exe Key opened \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Wine autostart.exe -
Loads dropped DLL 10 IoCs
pid Process 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 2848 autostart.exe 2848 autostart.exe 2964 autostart.exe 2964 autostart.exe 1532 autostart.exe 1532 autostart.exe 1200 autostart.exe 1200 autostart.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\autostart.exe autostart.exe File opened for modification C:\Windows\SysWOW64\autostart.exe autostart.exe File created C:\Windows\SysWOW64\autostart.exe autostart.exe File opened for modification C:\Windows\SysWOW64\autostart.exe 1d22cf354d01fb6e8e820e4ae126a179.exe File opened for modification C:\Windows\SysWOW64\autostart.exe autostart.exe File opened for modification C:\Windows\SysWOW64\autostart.exe autostart.exe File created C:\Windows\SysWOW64\autostart.exe autostart.exe File opened for modification C:\Windows\SysWOW64\autostart.exe autostart.exe File created C:\Windows\SysWOW64\autostart.exe autostart.exe File created C:\Windows\SysWOW64\autostart.exe 1d22cf354d01fb6e8e820e4ae126a179.exe File created C:\Windows\SysWOW64\autostart.exe autostart.exe File opened for modification C:\Windows\SysWOW64\autostart.exe autostart.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2848 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 25 PID 2164 wrote to memory of 2848 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 25 PID 2164 wrote to memory of 2848 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 25 PID 2164 wrote to memory of 2848 2164 1d22cf354d01fb6e8e820e4ae126a179.exe 25 PID 2848 wrote to memory of 2964 2848 autostart.exe 29 PID 2848 wrote to memory of 2964 2848 autostart.exe 29 PID 2848 wrote to memory of 2964 2848 autostart.exe 29 PID 2848 wrote to memory of 2964 2848 autostart.exe 29 PID 2964 wrote to memory of 1532 2964 autostart.exe 32 PID 2964 wrote to memory of 1532 2964 autostart.exe 32 PID 2964 wrote to memory of 1532 2964 autostart.exe 32 PID 2964 wrote to memory of 1532 2964 autostart.exe 32 PID 1532 wrote to memory of 1200 1532 autostart.exe 33 PID 1532 wrote to memory of 1200 1532 autostart.exe 33 PID 1532 wrote to memory of 1200 1532 autostart.exe 33 PID 1532 wrote to memory of 1200 1532 autostart.exe 33 PID 1200 wrote to memory of 1944 1200 autostart.exe 34 PID 1200 wrote to memory of 1944 1200 autostart.exe 34 PID 1200 wrote to memory of 1944 1200 autostart.exe 34 PID 1200 wrote to memory of 1944 1200 autostart.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe"C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 684 "C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 688 "C:\Windows\SysWOW64\autostart.exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 692 "C:\Windows\SysWOW64\autostart.exe"4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 708 "C:\Windows\SysWOW64\autostart.exe"5⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 704 "C:\Windows\SysWOW64\autostart.exe"6⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:1944 -
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 700 "C:\Windows\SysWOW64\autostart.exe"7⤵PID:2728
-
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 716 "C:\Windows\SysWOW64\autostart.exe"8⤵PID:696
-
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 712 "C:\Windows\SysWOW64\autostart.exe"9⤵PID:1680
-
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 696 "C:\Windows\SysWOW64\autostart.exe"10⤵PID:1620
-
C:\Windows\SysWOW64\autostart.exeC:\Windows\system32\autostart.exe 720 "C:\Windows\SysWOW64\autostart.exe"11⤵PID:1852
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5afb6ff03d850a7548f24ac96b09919c4
SHA167418c22ae4ed04fbf33aaf8a0e6af5dc05e1b4a
SHA25618576f3fea0ebaed52f2bc7e14d4f938567dde6e6216b37232173cb0b34d7838
SHA512a945b7de929e5127110b00a5a87b05f4161211e985bafbb0d473bf3463da2b7b1e985e12c4d4b3e9cff152f2059e1e5e6fe975f0306b6ee8b98bc2098794ad75
-
Filesize
256KB
MD5dd6d3712469542942294883211226fd2
SHA16d222e42e3b2e8e8fe1a8105fb95be1b2e9688f1
SHA2562084e63379fc0221da9eb8455726e216215b58da839833d4bfc538ec4780d6a1
SHA512a47cc0c0ffa5e497b3355e2d65f6a76479af474e76acf59e7f056191eec299858cb203fcab6baeebd2f16d838a9444de04fd6dcaa7c9418683753117d6ddba86
-
Filesize
189KB
MD5788d9fc00a4a917a235f049d5f26312d
SHA1ad22c6d7e331d3b3761eae60002f3504a6865e19
SHA2562ad46210b9886e085d56ca9fb7e6befc6bca72c1bc712884edfbbe8706b388d4
SHA51234894cbc58f39be6cbfce366ca6c682189912efdf1789b51eb2de0c6af4b0379fcb6201f919a745d3fff5bf6cc304b3f495cd3357b2baee34358865f354c574a
-
Filesize
33KB
MD5b9407bcfcdc45721123a8a875b375fb0
SHA16b6b7c9fca0f1d41f59bd03095d491ca56feddea
SHA256b23ea3cf8b87bf2cfb484483e90b92b92115f8ac62bd2e723ec3d206f6ba6a09
SHA512d097905887792b8a82d20ad5c898f34460c7a352634689fbe17009a12ae43f9e234338c161e02b97e4feb9f3a1865f4e41918fc6583139f50573feb05ba9c532
-
Filesize
82KB
MD5b929044af97e55498e06c6c5b86f4783
SHA1213a2cd046d6ac6b52f6ea1d74ecad5076adff45
SHA256a182b6c4628fc1dc8ddf7db774fbc0671d96c28fd5fb6b0fb21239fcb6a7975f
SHA512e23528a21324843f89c1d3e32842c64feac75829b8503ce22f87bcba7cd29ce3e2ef44b00a3abbb0a418779282bdee2b6d78f2515419cf8243c681f14b1cf890
-
Filesize
100KB
MD5fc718eae35a282812024d6e6aa437720
SHA15b7548cc19dedff99ede5ddbde470601ef2ae6f7
SHA2569006049ae5cdd95e32ad7e4f1df1307a45282aefa5be1009ce0870f85d3a7af7
SHA5128ad38e859a688bcdf4beeb20c351137ba4086d4bfaca2902076e4adf1674adb4a02f08083d91ad65d28fbab1e9da3433cadab34e304f595e959da7d3478ab1b8
-
Filesize
130KB
MD5cb1cee9be44ac9c018b1a300905bc068
SHA158ead99d03944141e9f95e31d68f9b06fc5d910b
SHA25638cb8062c4a7fb89091304267f79f6616eb8a480692c8c83d743b27cc9de3134
SHA5122c9f2a71be26054882d6f049ff9b95779ff07a9bfa69d25a76f7081b7bfba3bddfde7e67df84695a4390fd7e9e483b7ed35cc2be671c24c557e7b89bc35e11b5
-
Filesize
165KB
MD5b46f273318de9aa1eee9285b080fd698
SHA15d72cd83abe276bb76da046aa458194744e29401
SHA25620b8aa67b6f793c09f6063fdcc2903c24afe5f2cfd8f13fd0b408e0450561dbd
SHA5125bf509666a9d259998e0ba743cb4bdd415333c4c50b61dc91ea7a9197aec16ba43d8c8c6d9a3dc65922b2edb1669917525f528f261cdc417fad25b70b0bd757b
-
Filesize
127KB
MD5419954600fd348db1591d22fa30244af
SHA180567574517f549884bc8df09cf4b635c3a5f1ca
SHA2561e16987aacf23afcfea1e00811988bf749007f9c4ccc6424f3800095a8246be2
SHA512ec6ebe7bcff0ed919835f52a313429b67a006f59154bb23a72cec22796fe5315d2e04296fb8b5bdf48e5a13c2f7bdf8e2b2c9e51625bed621f86fe441f9e3956
-
Filesize
44KB
MD53b63acc788a6731ecd78052c7beef291
SHA1170c022b211baca92209e63b0a4058728d6e50e3
SHA2568be7faf78e81c030a399f08dd3c1112602b4e61f7439cc0010a083cff9ad06b5
SHA5126782d05efdcf6160a4e1a26e0c68657f55a3e3f80e41f2f2d018fc35cbce48002cd7dda1c87989e5f2767f5ac7515664f1ec801d1153627c0eb80fbb932d9479
-
Filesize
49KB
MD5bc90a427954af03ffc346d82446892b0
SHA105cd609f0237224517bc2ecfa1a1e79cd695fc39
SHA2563c629975cd556068b4df1f096ca48cb6e89ef552067496e760171381f64c3d6c
SHA5125954f759b7872e58f358506aad5ff3a17b91515abd55ab9c7539cbbe41900912050bb688541be3536b4e4f23c9cc314985040627cf11aa11b7ff1d4000c969a1
-
Filesize
5KB
MD57722d5ad1e5e11844541b8b6e54af278
SHA12825ac53b8615da05a442501c2b318a74e42367d
SHA2569a929bf0bad2ceb16c9f4b0095eff55427139d0b716c206813a0f7768936b2c4
SHA512ac5dabfaaa9e085ae33125b9816c9cab2f99ed09d391b54ca219d175cfd8e9d1d0db8bcd07e77493746d2ea03d3213a5fd2d1bfc10e1bb64b2c523d338299712
-
Filesize
22KB
MD543a523df443bbc6761b583f8435213bd
SHA10bfe1c7394e9e7ccb72beb60a15eef207172583e
SHA256606fa9de2eedc70a5050342d8a20ae0ba584ec033d10e1a7ca9ce7cc832f1b4c
SHA512734d23ba884103c44365bd021b55cf565a54a32fd784f26635b1e110ee568a0ae0d1ce46d113b9470d88a81cb1c14e062dc9adc3aad59c1c8356d3e92bbe5d59
-
Filesize
1KB
MD574f2318ee90f8b6fec92f23a7bbda5b1
SHA1c123dd22c29881c202e97cffc0b68aa09bc1db0f
SHA256f34a461559ee3c38406a3db76b9d5f9496ba390495a2443e32b5e913a1e80204
SHA512bedf14e98601d3aa42b89fd5d9ab869526e72b4495f50de07e39d2014f7037cc48976dd7a64dddaba63c8ce2f75a3ed210028f9ed1036206cde99e5596cfbdb5
-
Filesize
206KB
MD514f74aee8063290b8bed903b33aca131
SHA1e2abb8cc198514f3b65ad4848274ddf8614ab836
SHA256b258b4b6b4afbcfdff10a41ec013edf03264bd564c95667160bb4a51d1742b11
SHA512ea53ddeae64eae700fcab00f0e3a14069aac652197c1ca5ad732fceb7f3ee380a8282a39c97da9021351608d2e9c521ed0b0f402a0aded4d8e86a0f85ddeb860
-
Filesize
245KB
MD5bb500974aa0ae13bc51c8d92e5a1be39
SHA133f1afd8aa6053b49bf3d95ac95a94be8cd940bb
SHA256d82ebcf1618ada2d47961ae1de882751342c72d11852d36384ed0dd12872e106
SHA51215b5fa59c1f27854491615fc4db3ec68a3ed52b9d03b70463232e46b064489094e3b8f5351b11a47506d786672e4cdcaf0bed32e731e019b039ca17f153fb2c2
-
Filesize
165KB
MD5d28416a714f4984113c12f9b25a7d8b5
SHA1a233e7b8e4ed97deb07a5a0a94889db7d87ce86f
SHA256945a392cfd593ec6a2034b4dc3acff851b8a251713d4c81df7a4eee56ae4cf3b
SHA512eacf016a194db68553b27cacd49b8b02513bfc84cb0119c22f2c67a6b5673a02c95a7ac7835b4a4fe32e3042264e6310b7c848176d54e1735ff38580439d3554
-
Filesize
117KB
MD572d2849b1e23469eba52e68a50f1e866
SHA1dc7f1e48699ef007b59f61ea1d9c2dc8ba276084
SHA256874e0e049ee9103cbfe8903c668aefff0047c1837d295c1a54578838c77dd0f3
SHA5125252b324567b3f4e9d01f16fe8ed4c52726fce6789aaf7fbc4fe53c61df4f636ce7e8f2ea5131cc3a62cd19bf4b342e5e97bb85ed09ab9a9688ff6b3e96aa59e
-
Filesize
22KB
MD5a6071ae8aa2b7a80138206ce8698d598
SHA10ca8e11bbd27bc71ecdb27e9546e16209c0f9e15
SHA256ec79d3afcc92e323d4c42d2edd10871fbc0f8459c80583a73aa1acedecff26b1
SHA512e62f4cfdff82f28736ab7f7946d79aa58b3ac32db72ac52553872ad8aa9b0eb60537262bb30b34a8e843bd7754d3e9c7638abbbdb21fbb90f67a4e39d2f2e8d6
-
Filesize
74KB
MD5c54fb10b74b47efede99ed3cb229dd6d
SHA18ad86ce639e63f019df4412bd9f08552860c3a2e
SHA2568a42176e7211a3a2585762284abbc6ec2bd7e83c781ba212f39c7509341e0adf
SHA512e0b920f7be6c8be5d8c65eff1d6bbce67bc630e3e6c974d4d39f45a9da003247a649d1422e11b341e384611b2e6d3c17894da60579db66bbcbfda14ecb2f332d
-
Filesize
6KB
MD580cc899c6a0bfcd586719ad95660a2cf
SHA1a99c966b00a837c57e6d16155289a0bb4d5cca2b
SHA2568392892aa885a156737be17594f3a98795428a0eeedcf7af277cc8e7bf96cc73
SHA5123e25072507c8ef849ea86ce1d004133cee4bd467834d4edbaf0ad014c25927de72fd4d6024369b8d99b16d02c5d95f8fb59befd7e14c994d26ae51c301e3a98c
-
Filesize
67KB
MD5baa26e127d390bad2ba3ab7bf593baa9
SHA13f22aa44e3a1f9bb6c9072acedb23daacfa9c0cb
SHA2566c48fa2df57571133c7b4878c9678568cf0bca07570d925a88c9f2f30d853085
SHA512c6a10a62fd3b6d1b818cdf33b3557b3b6bdde9c8f4c6d8baaea610f32ed4864aa4f580ce85982a6b7aa77f28076efcfd59967145cdac8bd5575013ca916fc4d5
-
Filesize
84KB
MD5d8bb877f992742d49b7c671c3d9ed232
SHA112bad97c03aeb25c0d9492b53990a47b8f6cee71
SHA25629db8307093d934ffdd8d1fea3c4089c732b360ebd33c31622808136cb200bb7
SHA512738186ffc63f696c2e024d6f32010e904c188ed4979529ec33334385db1a98396388c1481de98986c6a0b63be765168a1aae44f4c034f078dfd14923bdbacb34
-
Filesize
136KB
MD5ebd7b13901530119d6edf8d38e437e1f
SHA129f7c4edec10f4dc63892753a4908e9a17f52251
SHA256a26aea08e26de967492e465c2710661819a30d64be34857455222d4c9e496a56
SHA51254d513c8f71a267aaaa05a03da5d9d0d374c51a9576a195920ffdafb8f174a2c5d3b7e85796d639722b7e34d5ab19758e2f40d363d5105ab58c49c4d714075d1
-
Filesize
99KB
MD5cc26f1746cba6ea3bb91f9d9c7553ff0
SHA165edb479f1790abf82cd5b5664a1e53d26c27d3a
SHA25683447018dd20bc592bb37551f1c17b87afb942e71baf56a7f2451ac06d35e5ac
SHA5125c98294a21d5b6fd882a2a257fbe158b8c29d1e3f025e4333e23de3fe85e282ed18608f7f303896b326748d9a0e00e36d398bb10c68e197282a10e835ebe7883
-
Filesize
41KB
MD580029f58526b0ff1abed82f9bcf9d7a2
SHA177a7275d1fd45add29da214386d3b5c1eefc7aff
SHA2567414247b4d489f438019e9c2a77fbaaa2e4f12fe7d46a2e8f04c6da0ded5e14a
SHA512983dcd17a6a99c47c05dd97749e54ee15af35271ca4382560bd8c2e4674f59758282b313f6301a7ce82d1a1ee3df0575eee4d87aa4315baa4de400828a441b9b
-
Filesize
128KB
MD515812f7044d5adaae0b20eafdcba9948
SHA145ae211a531c79f32ccccfae65ee8dd6fee75d33
SHA2564916335f64d7d37255004f1675a6e9cebf15d08a63cfb125027e1e4f35cb5c4c
SHA512a8082c3f3df60e8ebaff60e54a464aec7829fc40960921586d82c864c141de45a97218e9ea6322d70e898f7a2ad628628dfbde2201c14ab8f7ff73b662b772ce
-
Filesize
158KB
MD54944be974d27408e189e67ec4e1b2f58
SHA1f79dc648e615d70ecfe662622442f5e2fd6ecf44
SHA256feda96dd093b374061daffcb8a01adeaf7012dc0bda8cb6c36791ec05e127743
SHA5127ee4d281363f781c8a445daec22ed3f0f58afb1433a192050cac83bed9a0ae9dd87d9d6d70b2b2e680e4e5f64703137093d45410d72afeade7914fe2a51b1bb3
-
Filesize
63KB
MD54a7f8b1c33f0172741c7af893c00cbd7
SHA1b669ab64cbc38586e985bdb2e840097445b3af75
SHA256eff67f3f83cb5e9020144da088e7a1d18107e1cce55c9e03d79acc99492cf6a7
SHA512d4fdf308ca3b48c8e06c14c8a53472d65e90b5c6164a40542dc4ec270798ffbb735b3cfbfcd2bfd91409f6da12c59a0d4ded822a8bc1786139a9e756f93c178b
-
Filesize
42KB
MD5acd5a9c3d531391892434224329b19a5
SHA134f7491ac2083df3596b9a1227ca5bb6ea387f47
SHA25659414f3fb1de0c9cac4ce1dfb7e95bf72509dbf779062d65abd06a69217d0a60
SHA51260d6fe3062c358d453a1a61a209606b04b9b0f5dfc827912d558de0e1e733c98eca23952597fe6f46ba5bef2a48d24f1004ffc99f4bb5c9f32f568920cf32177
-
Filesize
120KB
MD577ff1b63b0ded265f1f34b9cd3b7d6b2
SHA10575aaf61aea85f80242923f30190d429a641525
SHA2564e146d859c9907f002f02e24724b521217dbd8436794c422981fc6130ad35dd1
SHA51214af83eeb49c835dbfa954fe55986313687db5361dbb3ef66c90c04457710a6a63d80525c726e4d541730289e78459a57bbd2c977457d7da74f388701d8debce
-
Filesize
97KB
MD510abeb771ba45ec7adcdb48bbee4f5cc
SHA19a233adb009e2d14c13b8667cee856185142a813
SHA25643cbf8cd73274e16bdfd99471001c5f887d470232248daf4c5d4a885f12704ee
SHA512ac33e0879e5bd59555b6cb155f028da0d651c0b16af8a7793e0b4594ed7e7a3ec5717ebaf063e1dbf0334ced3636777fda6675798ac6351511002723d59683ec