Analysis
- max time kernel
145s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
05/07/2024, 03:56
General
- Target archive/update/Uninstall/unins000 — копия (9) — копия.exe
- Size 1.5MB
- Sample240705-ehjadavaqe
- SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (9) — копия.exe"C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (9) — копия.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (9) — копия.exe" /FIRSTPHASEWND=$502C22⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_iu14D2N.tmp
memory/1372-6-0x0000000000730000-0x0000000000731000-memory.dmp
memory/1372-12-0x0000000000400000-0x000000000057D000-memory.dmp
memory/1372-15-0x0000000000400000-0x000000000057D000-memory.dmp
memory/4928-0-0x0000000000750000-0x0000000000751000-memory.dmp
memory/4928-11-0x0000000000400000-0x000000000057D000-memory.dmp