Overview
overview
7Static
static
4RevoUninst...lp.pdf
windows7-x64
1RevoUninst...lp.pdf
windows10-2004-x64
1RevoUninst...rt.exe
windows7-x64
4RevoUninst...rt.exe
windows10-2004-x64
1RevoUninst...sh.ini
windows7-x64
1RevoUninst...sh.ini
windows10-2004-x64
1RevoUninst...Un.exe
windows7-x64
6RevoUninst...Un.exe
windows10-2004-x64
6RevoUninst...Un.exe
windows7-x64
6RevoUninst...Un.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 14:00
Behavioral task
behavioral1
Sample
RevoUninstaller_Portable/Revo Uninstaller Help.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RevoUninstaller_Portable/Revo Uninstaller Help.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
RevoUninstaller_Portable/RevoUPort.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
RevoUninstaller_Portable/RevoUPort.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
RevoUninstaller_Portable/lang/english.ini
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
RevoUninstaller_Portable/lang/english.ini
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
RevoUninstaller_Portable/x64/RevoUn.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
RevoUninstaller_Portable/x64/RevoUn.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
RevoUninstaller_Portable/x86/RevoUn.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
RevoUninstaller_Portable/x86/RevoUn.exe
Resource
win10v2004-20240226-en
General
-
Target
RevoUninstaller_Portable/x86/RevoUn.exe
-
Size
12.2MB
-
MD5
15657f176a5eea4c0f943da107962d24
-
SHA1
2e4d2eaa1144ee1dd7d34fa580866a199e0012c7
-
SHA256
c6762c436785680d7a363821fa7d5767ec71fea45473501dee8c47007bf2b2c4
-
SHA512
880dbf849d041a96a61de84611c040bf674899bc0ecab693afe2cf911aa37cb537b83ecfd11525fce0d4758bdabe68092d17c6b5e2f4cde3fd58dc96f14bbf15
-
SSDEEP
196608:EH14G7PwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIA8Zk:FPWpGplR8ZWk
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
RevoUn.exedescription ioc process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe RevoUn.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\DisplayIcon.ico RevoUn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
RevoUn.exepid process 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe -
Suspicious use of SendNotifyMessage 10 IoCs
Processes:
RevoUn.exepid process 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
RevoUn.exepid process 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe 2192 RevoUn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x86\RevoUn.exe"C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x86\RevoUn.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.iniFilesize
310B
MD56ecaab031111fcce0ff2731ab3c8a9e0
SHA1c61ccbb6d71347c9e1673f4aa6210a0b0b11a6fb
SHA256b12344b2457877b2942e0ad4e47fd260a0f1b15451317122ecbc7a36ea0f65b6
SHA512b98053578cea8ab36fff704a403ebf18a438d96c941d48fa7a1326b08552e8b5a275eaf4d4d08e5bbbbde1eabdbb41e987269903949377544ad185971106ebbf
-
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.iniFilesize
808B
MD5f5a2526921b65b530daf69952d9ba658
SHA183f61b23d2ccc47551042df4503e633d5a5a2193
SHA2564e9336ad25f47d9e5a094f5fbb5b116a2fd213fca3249905ba515b3d28481c48
SHA5129bb3b29f2d46dd0a4e04fb4ae4c09fe48c09b0bb4ba34307be4081a2cf6ff4d0997bdeead2bc0e57aec61c84901d41501ef9ca45d2e87a0d73874bd02cbe80d3
-
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.iniFilesize
860B
MD5be0a819279589bdadf841c1dea2553c3
SHA12e703cc9aa1a2f0c34c43020b9c21049e3fd02a5
SHA256f963d0ccbcfab5fb945f73ebbfeab2c28724be1ee9807bf38e852af04b7a8aa5
SHA512dd49e60930f956221937326a7d0e4143cf23a1dca114bf73c9faaa2145c4b0155c59201d34dfa1cb903a28eaff7e5538d5db7e5e89955671f57ef82b9ecaa729
-
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.iniFilesize
998B
MD5bcc89ffb1f8032d120f329e08d9ed49b
SHA1399dad1f6b78ba114c1fa91ccf35eceb2465203a
SHA2562ade7d99e0252db6c1fc8040fec0e301670729d3e074b17ef4d6b02448760bf1
SHA512f970f97c5f71eeff24bd3241f57d315d977407b4d28e4791640d21a922363d2fc1979ea086791436deaf6422375465be700f34d081b2e7f0cc7eac5bd5206c8c