14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b

Analysis

max time kernel
314s
max time network
309s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspend.exe
Size 1.8MB
Sample260801-b151bavekf
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Wine	suspend.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	suspend.exe
4132	suspend.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	suspend.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	suspend.exe

C:\Users\Admin\AppData\Local\Temp\suspend.exe
"C:\Users\Admin\AppData\Local\Temp\suspend.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads