dc4b9964f4da9a26c5aac6594193cb4ea9e0b4eb2bac20158f98611405c3548a

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Revo_Uninstaller_Pro_5.1.1/RevoUninProSetup.exe
Size 16.8MB
Sample240206-ckd3bscha8
SHA256 21a5b0e1ab9d88eec56dcd1c2ff050742d73e87325922e0840502d211b77b22a
MD5 ab0d159cbe7e1f7f9adea455506f73b1
SHA1 a780054d4721e433387091233fd16c67ecbf3bec
SHA512 a28fb07060a33405a3d26d92c6479f77e4c403092b71471d0516cb4a431d2af55e48740c14622c6353066f53945ae8185aafb15f15b643ac4254dd26dd157ddc
SSDEEP 393216:LwA1pdJwTb+1yXa+v5wfFUSwwV6YWlw9Muo4O9W3XfCX5wRIa4o:MADdJYVNCtUS1VWlwa4O2Xfs5O4o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2680	RevoUninProSetup.tmp

Loads dropped DLL 1 IoCs

pid	Process
2420	RevoUninProSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2792	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2420 wrote to memory of 2680	2420	RevoUninProSetup.exe	28
PID 2680 wrote to memory of 2792	2680	RevoUninProSetup.tmp	29
PID 2680 wrote to memory of 2792	2680	RevoUninProSetup.tmp	29
PID 2680 wrote to memory of 2792	2680	RevoUninProSetup.tmp	29
PID 2680 wrote to memory of 2792	2680	RevoUninProSetup.tmp	29

C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe
"C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\is-EH8Q8.tmp\RevoUninProSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EH8Q8.tmp\RevoUninProSetup.tmp" /SL5="$4010A,16976201,196608,C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im ruplp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RevoUninProSetup.tmp

Path \Users\Admin\AppData\Local\Temp\is-EH8Q8.tmp\RevoUninProSetup.tmp
Size 1.2MB
SHA256 ca4deef34c1b27f92b0e571d057c5a71f786181aceb07797cfd59ad0b4027baf
MD5 fd527a16a9dd4fb499dbdaa78e1c2126
SHA1 91e2fa21419f53e5116235e0391ecb2a7fe8c8e0
SHA512 feea2a838d34d31d0053c6030866db4f9e3dad79cdd69088879912e205c465190fa29a798b41e025fef08c0d01774db107fc50d90aa0a0b8614aeb2acd0dbc9b
SSDEEP 24576:DnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtXxbqx9sk:bHeKh4nqzF3PYdStB+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2420-0-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2420-2-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2420-10-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2680-8-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2680-11-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/2680-14-0x0000000000240000-0x0000000000241000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads