Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
14-09-2024 07:21
General
-
Target
exe/version.dll
-
Size
5.1MB
-
MD5
5e9ff92f32c567e00a501c194f6aa507
-
SHA1
e7bb3dfb31cf8e9cd48de558b648b3868ab63269
-
SHA256
4f7c6ba05f9c2d4b847e898dd5eb33004a9dde0782d17b182768d301ff5d06a9
-
SHA512
2edd2b1f66a01663e67570c546e72872f70a995f9dcd27d9619258023400bbaa6b15f41dd48601e08572c0aeac1cd3f0eeb5fd7a3832e1dcd6af6acb889b0720
-
SSDEEP
98304:N8isYLlc4EqtHscSK5hilPNyEbeGV34tyAg3HuW+j3svi7EqPldcI9hY:6isYC9qtMYaPFbey34tyvr+j8axldcI9
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies registry class 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\exe\version.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
13.6MB
-
Filesize
8KB