c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da

Analysis

max time kernel
125s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Auto-Tune_EFX.dll
Size 36.7MB
Sample240601-ea5teagg6w
SHA256 476fb1a3b17fd711d240a3189f03aaa4831774fc18d2f08fed09818f8598483f
MD5 a36af06ff1a195bbe8d41043c07289dd
SHA1 3f42b8d44d51caa0433bb273985f289e1cc7bb97
SHA512 ac322416cf3e605aab12a82304770661166a365b1f3063d749fbfe473193601fb3057a2b9dbbbe5d55987af178678845b6d839c8c33d1f18f9e2bab1d4a46b6b
SSDEEP 393216:v2rTx+ArfUhCpzjVNaz5IbjTLlAVJa679INDMEzB5N8ZPbuxGC2:KohQjVsz5IbDCVIVNDDzzwbI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Wine\Fonts	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Auto-Tune_EFX.dll,#1
1⤵
- Identifies Wine through registry keys
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads