14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspend-3.2.1.exe
Size 1.8MB
Sample260731-kk7nmsff37
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Wine	suspend-3.2.1.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe
4424	suspend-3.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4424	suspend-3.2.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	suspend-3.2.1.exe

C:\Users\Admin\AppData\Local\Temp\suspend-3.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\suspend-3.2.1.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SMCSettings.json

Path C:\Users\Admin\AppData\Local\Temp\SMCSettings.json
Size 24KB
SHA256 e983636c03f52b6f3a9d71504f400ee24c7cc61bc52b9763311904dda636dab2
MD5 9ad387decddb14813345f45b39a9ad5a
SHA1 14aa739e6c403e06a566c6df79d6c556a4a695af
SHA512 0be507661058e55d22f0571d896db39fdc2575875b9443fa318e6e7b48f2f6f23dbfffc71073a25ecbda62c1b43a8675dc032a9bf0fd13dbb1d3f85c75ae7dc3
SSDEEP 192:WE+x2uD5wssZtOw3znVEBE+x2uD5wssZtOw3znVEK4g48jmHCHHqsnEX4w48DGHW:xznVEQznVEp3yn6
TLSH
T16EB28937D6544CBE24BDC63DC8399902E780835B29491D47B2BCADCD4FB33236A8A54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download