fd8b2fb37d0f146fef98dd7b6079fe40a4e04879e247f4a37ef12443ccf6c2b3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RevoUninstaller_Portable/x64/RevoUn.exe
Size

14.4MB
MD5

dcf9c35c8dcfb6e4d90bfe97ac1a2b92
SHA1

1b15760c97b292dcc891fcb0624819dfa7a66135
SHA256

affb9421aa7bc562616fe0793cdb454925640ccff027ca8350e6a06b3f24c4b9
SHA512

cfe55a92ca297dae4269a7b8a30148df871f244c67b52dbac085b12966121846cd306992585926fec56b6e7a150b5478611e53e40e5841d327a8ca2312be5846
SSDEEP

196608:bB1bn4g/F2S4afjAzM39fOrwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIa:bf0g/F2S4afjr9fOUPWpGplR8ZWS

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

Processes:

RevoUn.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	RevoUn.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\DisplayIcon.ico	RevoUn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

RevoUn.exe

pid	process
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe

Suspicious use of SendNotifyMessage 10 IoCs

Processes:

RevoUn.exe

pid	process
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

RevoUn.exe

pid	process
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe
2032	RevoUn.exe

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe
"C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2032

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini
Filesize
310B

MD5
6ecaab031111fcce0ff2731ab3c8a9e0

SHA1
c61ccbb6d71347c9e1673f4aa6210a0b0b11a6fb

SHA256
b12344b2457877b2942e0ad4e47fd260a0f1b15451317122ecbc7a36ea0f65b6

SHA512
b98053578cea8ab36fff704a403ebf18a438d96c941d48fa7a1326b08552e8b5a275eaf4d4d08e5bbbbde1eabdbb41e987269903949377544ad185971106ebbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini
Filesize
808B

MD5
f5a2526921b65b530daf69952d9ba658

SHA1
83f61b23d2ccc47551042df4503e633d5a5a2193

SHA256
4e9336ad25f47d9e5a094f5fbb5b116a2fd213fca3249905ba515b3d28481c48

SHA512
9bb3b29f2d46dd0a4e04fb4ae4c09fe48c09b0bb4ba34307be4081a2cf6ff4d0997bdeead2bc0e57aec61c84901d41501ef9ca45d2e87a0d73874bd02cbe80d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini
Filesize
860B

MD5
be0a819279589bdadf841c1dea2553c3

SHA1
2e703cc9aa1a2f0c34c43020b9c21049e3fd02a5

SHA256
f963d0ccbcfab5fb945f73ebbfeab2c28724be1ee9807bf38e852af04b7a8aa5

SHA512
dd49e60930f956221937326a7d0e4143cf23a1dca114bf73c9faaa2145c4b0155c59201d34dfa1cb903a28eaff7e5538d5db7e5e89955671f57ef82b9ecaa729

Download Submit
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini
Filesize
998B

MD5
bcc89ffb1f8032d120f329e08d9ed49b

SHA1
399dad1f6b78ba114c1fa91ccf35eceb2465203a

SHA256
2ade7d99e0252db6c1fc8040fec0e301670729d3e074b17ef4d6b02448760bf1

SHA512
f970f97c5f71eeff24bd3241f57d315d977407b4d28e4791640d21a922363d2fc1979ea086791436deaf6422375465be700f34d081b2e7f0cc7eac5bd5206c8c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads