Analysis
-
max time kernel
261s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
25/04/2023, 08:49
General
-
Target
version.dll
-
Size
2.5MB
-
MD5
f9b89da94ed247b257ae8bac48304611
-
SHA1
1637a3228884cf84b8f173e4249f2dc86193329a
-
SHA256
0f84cac377432974a2232b164bfc7451aa5c4445c878387725df97486531fbcd
-
SHA512
1dd2efc11287a1e917e008a826baadb721c68d1a3b8a6e0106306ae6dd85f2adfb782d4eb20d4020160304117ebd115a0c1c4996d84565e232d727eef7212096
-
SSDEEP
49152:+FIlhMg37EU2o+SxDOwmzJQNDPFsx/qssluv7eMSlwGkgaUcPqVn:+VEMXSxDOwmzJsPF3sBezlnkKcP4n
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 6283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4928 -ip 49281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB