Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-04-2022 17:50
General
-
Target
svchost.dll
-
Size
2.6MB
-
MD5
1e561bf546eef5bb80e25ae25720199b
-
SHA1
2b182d08aeb6a4740c543e7e4b0c85034e89953c
-
SHA256
5bda2ccd3e92981caa7e60e21efa4fb96b6d1f3657361232e4958d900d816d6a
-
SHA512
3299b2b5436d2e01736a73a03654d4620bd533cb2695c8b9abe4a60cbd42f0155d8f11cb7d3e636b9c5a5caae993db04070f9f828b50e1c9f137760f1f82d255
Score
9/10
Malware Config
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\svchost.dll,#11⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses