Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-12-2021 12:51
General
-
Target
imgengine.dll
-
Size
12.0MB
-
MD5
ef7de8e17a46bbb875ff5b48a5111f75
-
SHA1
1758ad8c4574dc8aba71ef4e541dd78579853826
-
SHA256
4563e5ab64572adb62bc0e4e6c472b4c6485c9e5af3aa40dc17d84170c442e82
-
SHA512
0a7a0316856c766fb0ec8dae0519acb480d3e1c738c4a2ba442cb8cc5e67b920839ade09bc69e54eb406bb4575cae9fd1958512c25a826e134d4d036b744fd80
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\imgengine.dll,#11⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2708 -s 5602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
30.3MB
-
Filesize
30.3MB
-
Filesize
30.3MB
-
Filesize
30.3MB
-
Filesize
30.3MB
-
Filesize
8KB