Overview
overview
5Static
static
5NFV6M.zip
windows10-2004-x64
1NFV6M.zip
windows11-ltsc_2024-x64
1auth\ImsVwbCJXTAp.exe
windows10-2004-x64
4auth\ImsVwbCJXTAp.exe
windows11-ltsc_2024-x64
4rename.exe
windows10-2004-x64
4rename.exe
windows11-ltsc_2024-x64
4vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1version.dll
windows10-2004-x64
4version.dll
windows11-ltsc_2024-x64
4Analysis
- max time kernel
148s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 01:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
NFV6M.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NFV6M.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
auth\ImsVwbCJXTAp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
auth\ImsVwbCJXTAp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
rename.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
rename.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
version.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
version.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target version.dll
- Size 124KB
- Sample260831-bvs4kack4v
- SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
- MD5 410af86d672a4886ff7ecae3c8c0c5a7
- SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
- SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
- SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
- TLSH T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
ioc Process \??\VBoxMiniRdrDN ImsVwbCJXTAp \??\VBoxMiniRdrDN ImsVwbCJXTAp - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\psuser.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_am.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\psuser_64.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_vi.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_is.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_af.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_lo.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\MicrosoftEdgeUpdateSetup.exe BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\EdgeUpdate.dat BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_es.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_sk.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_quz.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_as.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_kok.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_lb.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_bn.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_da.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_lt.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_fi.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\NOTICE.TXT BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\MicrosoftEdgeUpdateOnDemand.exe BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_fr.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_te.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_tr.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ar.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ru.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_pl.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_lb.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_en.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_id.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_kk.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ne.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_fr-CA.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_ka.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_tt.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\MicrosoftEdgeUpdate.exe BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_bs.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_kk.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_mi.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_or.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_sr-Cyrl-BA.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_fil.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_cs.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_gu.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_hu.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_nb.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_az.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_bn-IN.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_km.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_is.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_zh-TW.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ga.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_ca-Es-VALENCIA.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_lo.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_ug.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_am.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_lv.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_et.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_ja.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ca-Es-VALENCIA.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\msedgeupdateres_te.dll BITF27F.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU3FE2.tmp\msedgeupdateres_ug.dll BITF27F.tmp File opened for modification C:\Program Files (x86)\Microsoft\Temp\EU413A.tmp\MicrosoftEdgeUpdateSetup.exe BITF27F.tmp - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITF27F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wct318A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITF27F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wct318A.tmp - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ImsVwbCJXTAp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ImsVwbCJXTAp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ImsVwbCJXTAp Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ImsVwbCJXTAp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ImsVwbCJXTAp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ImsVwbCJXTAp - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1356 wct318A.tmp 1356 wct318A.tmp 2732 wct318A.tmp 2732 wct318A.tmp - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 1440 ImsVwbCJXTAp Token: SeSystemEnvironmentPrivilege 4856 ImsVwbCJXTAp - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4384 3288 rundll32.exe 85 PID 3288 wrote to memory of 1440 3288 rundll32.exe 86 PID 3288 wrote to memory of 824 3288 rundll32.exe 87 PID 3288 wrote to memory of 1692 3288 rundll32.exe 88 PID 3288 wrote to memory of 2732 3288 rundll32.exe 89 PID 1692 wrote to memory of 732 1692 rename.exe 90 PID 1692 wrote to memory of 4856 1692 rename.exe 91 PID 1692 wrote to memory of 1640 1692 rename.exe 92 PID 1692 wrote to memory of 1356 1692 rename.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\2586682621\zmstage.exe"C:\Users\Admin\AppData\Local\Temp\2586682621\zmstage.exe"2⤵PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp"C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\BITF27F.tmp"C:\Users\Admin\AppData\Local\Temp\BITF27F.tmp"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\rename.exe"C:\Users\Admin\AppData\Local\Temp\rename.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2586682621\zmstage.exe"C:\Users\Admin\AppData\Local\Temp\2586682621\zmstage.exe"3⤵PID:732
-
-
C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp"C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp"3⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\BITF27F.tmp"C:\Users\Admin\AppData\Local\Temp\BITF27F.tmp"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\wct318A.tmp"C:\Users\Admin\AppData\Local\Temp\wct318A.tmp"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1356
-
-
-
C:\Users\Admin\AppData\Local\Temp\wct318A.tmp"C:\Users\Admin\AppData\Local\Temp\wct318A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
- Size 77B
- SHA256 0aacaf6ad91c574712ab8b2ceb57529f92bb41a456750e19b8aae051db0b2002
- MD5 d53920807f248cd1ec0aa077c9c756ac
- SHA1 fd5bb6150527756fd8b7a2eb15563f359d4ee8b9
- SHA512 705d042eb670731185f8b3d6ea66d49f636f556744f49a524421e98c68fb43fb9c4a42d76b2f783a97eabc2d52ec9e3b5af8da3a2ac084171b29ddfa9b563585
- TLSH T1C7A011B00202032B0238AAAB20B2000E08F88BE8A0880028282A3A000A2C288A832022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2026-08-31.0128.1356.1.aodl
- Size 5KB
- SHA256 5b750b1bf3ad68559a4197d504df38ac09e0d5d107e585a02ccf344e1ed4cfdd
- MD5 93b93cc5db1a6798111908b223ada3a6
- SHA1 5ef11eeabcf93fed1ba58c4e0934c6183a3bb81e
- SHA512 b28d29463788256ebb141adf2572b59de4925999d0076f1b763b074c3d90cba177b084d46e56efbeb9fef084440f3b77bcd8b8cc962f79be50aac678e76bee79
- SSDEEP 96:HI50J1U1tu4vNAEAN67gfKuNiqz2KGIMWlsuWun:HI50Un1AEAigSuAqz2y7vn
- TLSH T1A5C1AE69F8954991C680403C5890CE2F2FB8DAECC1E7D18AAEC5BFA7B55572DB7C3600
- MD5 SHA1 SHA512 SSDEEP TLSH