Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19/08/2024, 15:53
General
-
Target
Workshop www.unlockmexico.net/cdma_workshop_FULL_Cracked.exe
-
Size
4.3MB
-
MD5
3ddb3343e004556e253a9a421b1b441d
-
SHA1
801b1a526d1b4ba3e84bdf8669f5dbf65b5a38f7
-
SHA256
797c7933e57214943163beee1f3f157d000b7d5df8a895feeddec70cc9352560
-
SHA512
7e5d3dbcff6502ad628a2f9bd95e03c7b5930d70c548742c487850f15b7508eb4089840526f7bb062d4cf26b0bf85eb12e62e34833d46d08cd07c925fd91c2a5
-
SSDEEP
98304:b/GpdQ7ECtEWFeMuOl5/3HQsIs7p0DI0Zx+mAbe7Xg1M4mw+:LGp0FjuGB3wHi0DVv+fWXg1M4/+
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Workshop www.unlockmexico.net\cdma_workshop_FULL_Cracked.exe"C:\Users\Admin\AppData\Local\Temp\Workshop www.unlockmexico.net\cdma_workshop_FULL_Cracked.exe"1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.8MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
11.8MB