General
-
Target
RevoUninProSetup.exe
-
Size
16.9MB
-
Sample
240524-vve2gsde44
-
MD5
b0f15df675ff3ff11fe6eac7a32e4409
-
SHA1
59178aed358362c8fb3905e66170ac924c803879
-
SHA256
89d038c065e1e236a4c086f9485dbf1315114ed92eed19e64d2e3fe771688d9a
-
SHA512
3f1d56d12948872632fe626e61533790852a54c892385c8d1cf8b6111a6ee4379bcc907958d6b8d82736476e2b9b9be6e53604c494227ae370d2496b84b48a47
-
SSDEEP
393216:4S2H6AdClOaamBv1XONf50LdeJ/mXjGyh+OLTvrGVJCmY0mB:RE6AdDwhc5IeNxyh+OPDGVJCmnmB
Static task
static1
Behavioral task
behavioral1
Sample
RevoUninProSetup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
RevoUninProSetup.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
RevoUninProSetup.exe
-
Size
16.9MB
-
MD5
b0f15df675ff3ff11fe6eac7a32e4409
-
SHA1
59178aed358362c8fb3905e66170ac924c803879
-
SHA256
89d038c065e1e236a4c086f9485dbf1315114ed92eed19e64d2e3fe771688d9a
-
SHA512
3f1d56d12948872632fe626e61533790852a54c892385c8d1cf8b6111a6ee4379bcc907958d6b8d82736476e2b9b9be6e53604c494227ae370d2496b84b48a47
-
SSDEEP
393216:4S2H6AdClOaamBv1XONf50LdeJ/mXjGyh+OLTvrGVJCmY0mB:RE6AdDwhc5IeNxyh+OPDGVJCmnmB
Score8/10-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2