Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 07:21
General
-
Target
prs/version.dll
-
Size
4.3MB
-
MD5
8a2fc7ebc76da1e8678935f5f4a44ed7
-
SHA1
b48c739c9ccdfa2754debc6eaf43b9604891725e
-
SHA256
8ad2ddc42e5f00c1a88193ad89c1cc65fca983122d705155534154601c9ce28e
-
SHA512
6f5afab2261d9078a6f809f8bf40799fed4136cb33a96138efabc704dba140348542c29d2a2ed128cba7ecb5b0d0de138031c9d76a54c651599a66edd6c58825
-
SSDEEP
98304:iIlGfN1CcHe3M6GeQRqIajWggLdWSor0dflm9Qx3g5wwaW5xe6jL:hlGfDCYe3M6usIWWfvoriflAQxQdaWzL
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\prs\version.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
8KB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB