Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/02/2024, 11:52
General
-
Target
971716cef15d3e59c057b9940f4becd2.exe
-
Size
747KB
-
MD5
971716cef15d3e59c057b9940f4becd2
-
SHA1
4d0746d12daa9abf14243d94f83794e9897ea1f0
-
SHA256
19865ea94a5da517595891708ff8e073f614c632e31af9d92375c5305e2fbe04
-
SHA512
c82a1e4406222d8052b53735679b8c610a07527b5978e29b4f1ad5351971e1ee8b300af232633bac365e06acff154207b143e403d811a71984a8f582209217e4
-
SSDEEP
12288:ZnbCEA5T43iu/C+e1biKqigF8rN4szIrusoiTKaaKtnvQeoqsNBeNRU/wpgE:Zn2SSeC+e12KqigIgusPTKaRtaxANRoe
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Themida packer 15 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\971716cef15d3e59c057b9940f4becd2.exe"C:\Users\Admin\AppData\Local\Temp\971716cef15d3e59c057b9940f4becd2.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB