95a5f946e1028bde119896d32be8792e8e26bf385e146dc305aa1a8a8bc95faf

Analysis

max time kernel
43s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

52KB
MD5

1e7d73cc09c8c48631e2b5fa359c7389
SHA1

4e73ca4278a145cbbe08284992fb261dc0f6d347
SHA256

352e934eab22ac0f75a4149d8354181c495a3f8634c074e50a6f15d2d2aa8998
SHA512

5452a18fea3bea63754229d30aa90ef3f21d6ce7d78235f174e70095412f677ad98e4ada0e9f04acff2aa802a5ebd22292c8bf64657ebc7978ffa7738c161112
SSDEEP

768:Rsy/X/meXJ+1DBWfeDJeUmoV48buMN51G655sLrLfcY:RzLJLftUlG4DX5MH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4620	uninstall.exe
4620	uninstall.exe
4620	uninstall.exe
4620	uninstall.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4620	uninstall.exe

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...