Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
01-07-2024 20:45
General
-
Target
Uninstall Wheel of Fortune.exe
-
Size
59KB
-
MD5
7af6402044280736d1d47b6939159b47
-
SHA1
9ddb8c2f5349d37a2e1bfe8398aee60f7341a1db
-
SHA256
c20681e888f3489b87b4602050f236125900114b50aadfe34d5c84c44ba38289
-
SHA512
da13e301f6a046f938e5b3c706e7769be3964ad47640b368b0b538d4be60fc4325901f5ec3d193bfacd53c54f71000ebb3e12679708fdfe6f50ff0515a6419c1
-
SSDEEP
1536:0G0Db1wJdBREzA01xVubM8JMLeAyBdgsgmimq7:oDb1wHBe6bM8JgeA4CsI7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
NSIS installer 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe"C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD57af6402044280736d1d47b6939159b47
SHA19ddb8c2f5349d37a2e1bfe8398aee60f7341a1db
SHA256c20681e888f3489b87b4602050f236125900114b50aadfe34d5c84c44ba38289
SHA512da13e301f6a046f938e5b3c706e7769be3964ad47640b368b0b538d4be60fc4325901f5ec3d193bfacd53c54f71000ebb3e12679708fdfe6f50ff0515a6419c1
-
Filesize
4KB
MD5419d642fe3436fda8bb22eea9c37a6ca
SHA1c1644131b880c6e03f14de3c79efd27093a77908
SHA25625c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7
SHA51229df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337
-
Filesize
4KB
MD58bb77ed61759966728b7cb065e0081ee
SHA1b2f1407daf21b301abea7a20cdb7fd181e3ff042
SHA256ab5496eef3b68e865ef79bca1a88813876589d7d63bc76808d6df38a88eaeb80
SHA512419541ad425373dab928f00e60bf83b19d53268e6d151d467a13dfabdb7a6a179b93c3f51c7fce394b062d619fdfcac587e3c7110ce1582c9d5e7ef85ec4cdf3