dc4b9964f4da9a26c5aac6594193cb4ea9e0b4eb2bac20158f98611405c3548a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Revo_Uninstaller_Pro_5.1.1/RevoUninProSetup.exe
Size 16.8MB
Sample240206-ckd3bscha8
SHA256 21a5b0e1ab9d88eec56dcd1c2ff050742d73e87325922e0840502d211b77b22a
MD5 ab0d159cbe7e1f7f9adea455506f73b1
SHA1 a780054d4721e433387091233fd16c67ecbf3bec
SHA512 a28fb07060a33405a3d26d92c6479f77e4c403092b71471d0516cb4a431d2af55e48740c14622c6353066f53945ae8185aafb15f15b643ac4254dd26dd157ddc
SSDEEP 393216:LwA1pdJwTb+1yXa+v5wfFUSwwV6YWlw9Muo4O9W3XfCX5wRIa4o:MADdJYVNCtUS1VWlwa4O2Xfs5O4o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	RevoUninProSetup.tmp

Executes dropped EXE 1 IoCs

pid	Process
1184	RevoUninProSetup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
488	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1184	1872	RevoUninProSetup.exe	84
PID 1872 wrote to memory of 1184	1872	RevoUninProSetup.exe	84
PID 1872 wrote to memory of 1184	1872	RevoUninProSetup.exe	84
PID 1184 wrote to memory of 488	1184	RevoUninProSetup.tmp	89
PID 1184 wrote to memory of 488	1184	RevoUninProSetup.tmp	89
PID 1184 wrote to memory of 488	1184	RevoUninProSetup.tmp	89

C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe
"C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\is-7QGU2.tmp\RevoUninProSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7QGU2.tmp\RevoUninProSetup.tmp" /SL5="$401C4,16976201,196608,C:\Users\Admin\AppData\Local\Temp\Revo_Uninstaller_Pro_5.1.1\RevoUninProSetup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im ruplp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RevoUninProSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7QGU2.tmp\RevoUninProSetup.tmp
Size 1.2MB
SHA256 ca4deef34c1b27f92b0e571d057c5a71f786181aceb07797cfd59ad0b4027baf
MD5 fd527a16a9dd4fb499dbdaa78e1c2126
SHA1 91e2fa21419f53e5116235e0391ecb2a7fe8c8e0
SHA512 feea2a838d34d31d0053c6030866db4f9e3dad79cdd69088879912e205c465190fa29a798b41e025fef08c0d01774db107fc50d90aa0a0b8614aeb2acd0dbc9b
SSDEEP 24576:DnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtXxbqx9sk:bHeKh4nqzF3PYdStB+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-5-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/1184-8-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1184-11-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/1872-0-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1872-7-0x0000000000400000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads