Resubmissions

21-06-2024 12:42

240621-pxhmhazeng 10

21-06-2024 12:28

240621-pnlmsszbna 10

21-06-2024 12:27

240621-pm82pszbld 10

Analysis

  • max time kernel
    138s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 12:28

General

  • Target

    Venus Tool/crack.dll

  • Size

    5.0MB

  • MD5

    b5b1b26e855eda6268b9a2008e0fce86

  • SHA1

    d7925f7de5835e3564b187d8654bb9305ea945fb

  • SHA256

    06dec4f9857f7b9a43157756606546d04a0f34c87681c7db9aab9125a43b33a7

  • SHA512

    14ad2e93ed5876dd246ce6f32674e994b4f35a5acbb1ac46388bebc682a70ce4eca974fda102c273c71dae3c9bc7b69f965fd636cb2d5c579de9cd23e8b35799

  • SSDEEP

    98304:j+YCYfXbb8DckgAEhxWiHF/5DoNZ2qkFVwz7583lfdmjLdGGf:jP8QDDRF/eNsqgiZ

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Venus Tool\crack.dll",#1
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    PID:3288
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
    1⤵
      PID:2960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3288-3-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-0-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-1-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-4-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-2-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-5-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-6-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB

    • memory/3288-7-0x000000005A360000-0x000000005AD3F000-memory.dmp
      Filesize

      9.9MB