ac645fa7e24f32f31802d6d7f199757222447afc43e70968d7a67dae23c2f2b4

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Z_Admin1.05/Z_Admin.exe
Size

1.5MB
MD5

25909fa8e7e19fac319c2f2db1406ae6
SHA1

2d9754e96be7a9492d2dcd3407ea7ee3dbc03cc2
SHA256

3a9cd9a922bbd4e4b0d81bb115c87daeee3f8c63f10d5879403a520f413f2dcc
SHA512

2c43439c5efbf4d5e7421b724c041d7d8335cbf0be9b3912960122bc9c7fd7972d6568c24c17d575ae0f0017f7101ee436bc70ee2d4ebbbeb65e15fc30f73d8b
SSDEEP

49152:Fxb3ts/zKrIG6V44z1aNgkPe/92ATEMUI:5gKUd1aNxanU

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	Z_Admin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3056	Z_Admin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	Z_Admin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	Z_Admin.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3056	Z_Admin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	Z_Admin.exe

C:\Users\Admin\AppData\Local\Temp\Z_Admin1.05\Z_Admin.exe
"C:\Users\Admin\AppData\Local\Temp\Z_Admin1.05\Z_Admin.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\finesse subzero - standard.ini

Filesize
13KB

MD5
3e50781e5bba7fcbf1fd59293b77b37a

SHA1
ce41c412347434d339ad41d05d579500524ed888

SHA256
4cfd4542090311b454572f77e7616ba9737631daa78c699593266ee16a23c399

SHA512
2799ba3008db4d1fabd0a0b0cf42dc897eed2ab7596a6a30d29e3f56d8471a052d68f3de2a8947e21e647ac1b5c9194f576db4545c270c7bb8b88edc5afbfa3c

Download Submit
memory/3056-559-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-570-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-1-0x0000000000401000-0x000000000046B000-memory.dmp

Filesize
424KB

Download
memory/3056-2-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-319-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-553-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-554-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-555-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-556-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-557-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-558-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-0-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-38-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-560-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-566-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-563-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-564-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-565-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-562-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-567-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-568-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-569-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-561-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-571-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-572-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download
memory/3056-573-0x0000000000400000-0x00000000006FC200-memory.dmp

Filesize
3.0MB

Download