Resubmissions
12-06-2024 20:59
240612-zs4dhszemh 712-06-2024 20:51
240612-znh7satdkm 712-06-2024 20:47
240612-zkx7jatclk 7Analysis
-
max time kernel
50s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
12-06-2024 20:47
General
-
Target
ntmssvc.dll
-
Size
5.3MB
-
MD5
6588b099f03fc61bca79b987cfbcd897
-
SHA1
f3e30967ad67ef220512552dde22179c2b4af82e
-
SHA256
f1c8aa3fcb7d27a2d7f5645de0713803c181408c082a67c6ac24f7c3b76d3117
-
SHA512
3d842b58ea4df039e8d8311293421babe4bfb015159a7400ee8a19ee373a321d87e489c2fbd02fa8282d879d75fb8da50c9f9f912d31487706979134413545a4
-
SSDEEP
98304:p/PzxVvzRLIvECcaIj3Q9QL3dGVL7xaEY8jCZeKgq841zEdlUP9gu0IVDPS6kszs:B1VVOW3QSL3dGVlCgquIP9gHamzlX0c
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ntmssvc.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB