Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 11:07
General
-
Target
AJProxy_3.0/Growpai.dll
-
Size
5.1MB
-
MD5
820f600e343d5759d8ead9549655ba16
-
SHA1
20fc71302fb0b24c90f97d33926d3a3dc4193ec2
-
SHA256
27edfdebaa896c849b0fe1c354d3bb82bb70807cb870bbaafa87146026502c4f
-
SHA512
a3019b7bf24cb7f971a5e05479e382139000053ee8c9b011f58b2b01e6235a9b4365b571105c23a2ccfccade95ae1e0339dccfacb51eeb5cc7e5d071369119cf
-
SSDEEP
98304:bc5Vo7LeRRDoiif0xJmth8TcZ9fCi4UmoJcs9juLgt59302x:Yo2wKmthVZtCiVm1XMptx
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AJProxy_3.0\Growpai.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
13.3MB
-
Filesize
13.3MB
-
Filesize
13.3MB
-
Filesize
13.3MB
-
Filesize
13.3MB
-
Filesize
13.3MB
-
Filesize
13.3MB