Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
05/07/2024, 03:56
General
- Target archive/update/Uninstall/unins000 — копия (7).exe
- Size 1.5MB
- Sample240705-ehjadavaqe
- SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (7).exe"C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (7).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (7).exe" /FIRSTPHASEWND=$E003C2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_iu14D2N.tmp
memory/2548-0-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/2548-11-0x0000000000400000-0x000000000057D000-memory.dmp
memory/5112-6-0x0000000002310000-0x0000000002311000-memory.dmp
memory/5112-12-0x0000000000400000-0x000000000057D000-memory.dmp
memory/5112-15-0x0000000000400000-0x000000000057D000-memory.dmp