2d7b1d385d39ef9529f8dce7d72d4002cc944639836efd1308772a8a002d5f91

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ha_Photilla-v1.0/Photilla 1.00/uninst.exe
Size

400KB
MD5

e1aa743888b73afc421eb3d23af05561
SHA1

e68aa8cdba201cdb8b801b041f4083e95d1dab6f
SHA256

b7ba22071f78978b714b196b8cb1bbebfc054a5d3c34836ad61766085ea9955a
SHA512

9e8874b981aa426d69490bdf71e8d14262897f5aabdc36a93b7342d260d9631a31bda501edc0cd178f80c617fa3e04e726c825f2e696bcb84facaf0d1d0f4175
SSDEEP

6144:i+805JE4xkiVexNUwA4IHk6Xa6+wdPzh4cXwee5QWow:i+8uyo9VNH46+RcXeLow

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	uninst.exe

Loads dropped DLL 4 IoCs

pid	Process
2204	uninst.exe
2204	uninst.exe
2204	uninst.exe
2204	uninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	uninst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28
PID 2204 wrote to memory of 2796	2204	uninst.exe	28

C:\Users\Admin\AppData\Local\Temp\ha_Photilla-v1.0\Photilla 1.00\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\ha_Photilla-v1.0\Photilla 1.00\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\uninst.exe
  "C:\Users\Admin\AppData\Local\Temp\uninst.exe" -u
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\uninst.exe

Filesize
400KB

MD5
e1aa743888b73afc421eb3d23af05561

SHA1
e68aa8cdba201cdb8b801b041f4083e95d1dab6f

SHA256
b7ba22071f78978b714b196b8cb1bbebfc054a5d3c34836ad61766085ea9955a

SHA512
9e8874b981aa426d69490bdf71e8d14262897f5aabdc36a93b7342d260d9631a31bda501edc0cd178f80c617fa3e04e726c825f2e696bcb84facaf0d1d0f4175

Download Submit