443058d8384fa38880357e1e204a7f7b156da016082ba2bc3be894f8d336bb0f

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
archive/update/Uninstall/unins000 — копия (10) — копия.exe
Size 1.5MB
Sample240705-ehjadavaqe
SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
MD5 3ab31d714c50ae078f9eaba7b2497191
SHA1 45c5e807e459d95618c03a6ded9debe1d70013f3
SHA512 f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2832	_iu14D2N.tmp

Executes dropped EXE 1 IoCs

pid	Process
2832	_iu14D2N.tmp

Loads dropped DLL 3 IoCs

pid	Process
2848	unins000 — копия (10) — копия.exe
2832	_iu14D2N.tmp
2832	_iu14D2N.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30
PID 2848 wrote to memory of 2832	2848	unins000 — копия (10) — копия.exe	30

C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (10) — копия.exe
"C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (10) — копия.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
  "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\archive\update\Uninstall\unins000 — копия (10) — копия.exe" /FIRSTPHASEWND=$6011C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

_iu14D2N.tmp

Path C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
Size 1.5MB
SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
MD5 3ab31d714c50ae078f9eaba7b2497191
SHA1 45c5e807e459d95618c03a6ded9debe1d70013f3
SHA512 f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-IUT3J.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2832-8-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/2832-16-0x0000000000400000-0x000000000057D000-memory.dmp

Download

memory/2832-19-0x0000000000400000-0x000000000057D000-memory.dmp

Download

memory/2848-4-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/2848-15-0x0000000000400000-0x000000000057D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads