Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 12:39
General
-
Target
MSS32.dll
-
Size
957KB
-
MD5
01c14c4c2b8568a3e8d2004c5930fed7
-
SHA1
57ca5229b6c233d407061ec1f038da34b07bdf8c
-
SHA256
a0ef00858d423763fa4aec6d0afa6cc9d9ebccf15717d183419f850402f2b546
-
SHA512
ba2395e97acf7acaf8d840b408901f0547b2c164a262e56767cea2422dd8948c6613193c3b109d776200d36d57a0f800cc0f6462d602a389ffced9e450ac4400
-
SSDEEP
24576:5BBCQFgtnGyfZ1ybM0OPj9RFPGEHouQOnYsdW1CJEx3:PBCGgtGMgM/FPGa/vnYsdW1uEx3
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MSS32.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MSS32.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
-
Filesize
8KB
-
Filesize
2.2MB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB