79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_4_/Update/Updater.exe
Size 703KB
Sample240224-vkn7eaha52
SHA256 ec6beb5b3a142ce2aa219cc3b7556c69d13389a3f1cc4582bf6ff915b62f6635
MD5 899a0e5ad7f9bb816a49ad8722309d63
SHA1 53605907568452a0c0b80d2feac7eef3f325920d
SHA512 05c85850a2e39f36c43b4d38632b184ecf4cffea2a966735c2951c8cc3e5563498aba574a0e6282f7cd836b2bb069811d42cc1f8bb25ac1c0886abaf90972abf
SSDEEP 12288:Va9zNU8kRagBIHGRRYP7vt8khukmPboYO6dwkaNTuof93a:VaBNRk8tmRRYek0ZPboYxdwkaNTuh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Software\Wine	Updater.exe

C:\Users\Admin\AppData\Local\Temp\$_4_\Update\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\$_4_\Update\Updater.exe"
1⤵
- Identifies Wine through registry keys
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads