Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 20:54
General
-
Target
03bdbb249e6841eec5c2f0f5b775a048.exe
-
Size
1.6MB
-
MD5
03bdbb249e6841eec5c2f0f5b775a048
-
SHA1
807773694242faa68f2d820aae54752b218f2e83
-
SHA256
883ea30ab5b21c5a53fdd90726fcf14512d1c82890c512a94eecf17185d9e31a
-
SHA512
e8722c1dd2301f5ab2227cc232746529c5b94b1667a01babdf60a0a614795cc3379ae97c79fffab352835a4ac8066ea6a58d5b6c649097ba88ead23ac8440c09
-
SSDEEP
49152:RFrpyKOU5s5b6sdteQOHxol2DrYolwuUNlpYx8+:nrSlbNQJHU2/7/k7Yx8+
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03bdbb249e6841eec5c2f0f5b775a048.exe"C:\Users\Admin\AppData\Local\Temp\03bdbb249e6841eec5c2f0f5b775a048.exe"1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 17082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4772 -ip 47721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB