d19b63c29337e2b077a54885fa1c67d93a7ec69e0c512b6a8ee435f49acd5fd0

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VaAux2_64.dll
Size 1.7MB
Sample260903-2ee5wattex
SHA256 d19b63c29337e2b077a54885fa1c67d93a7ec69e0c512b6a8ee435f49acd5fd0
MD5 49e226426b01c70b396953d8bba6af4c
SHA1 e6ad1eced5cadb2e109398e788e7a092ef171f4b
SHA512 08238742dacaa075dbb0b43dcd069ac4a489f4bce84c836928bd89b67627e46d5bf30a052673c8cb6de795741312fcb113f4ee24ee897e88a17d13eab6b8dfdf
SSDEEP 24576:f7H+pVEsE2jGbX24aLShqA5RqLH4uGs34YB+g+VE2dYPH3Z55PTnbWVQP40nqgZs:zH+NGiUdM+oPH3X5PTb5Pde3agh28Gg
TLSH
T135858C0AFA6581E1C07BC0BDD593662EF9B130A54B305BC757449B5A1F33BE4AA3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rundll32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F451B609-5A5E-C237-EA69-158A68B33219}\InProcServer32\ThreadingModel = "both"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F451B609-5A5E-C237-EA69-158A68B33219}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F451B609-5A5E-C237-EA69-158A68B33219}\ = "DMRC_PSFactory"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F451B609-5A5E-C237-EA69-158A68B33219}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F451B609-5A5E-C237-EA69-158A68B33219}\InProcServer32\ = "%SystemRoot%\\System32\\DeviceMetadataRetrievalClient.dll"	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4540	rundll32.exe
Token: SeIncBasePriorityPrivilege	4540	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VaAux2_64.dll,#1
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-1-0x0000028E8B0E0000-0x0000028E8B28D000-memory.dmp

Download

memory/4540-7-0x0000028E8B0E0000-0x0000028E8B28D000-memory.dmp

Download

memory/4540-8-0x0000000180000000-0x0000000180202000-memory.dmp

Download

memory/4540-9-0x0000028E8B0E0000-0x0000028E8B28D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads