Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
05-07-2024 16:45
General
-
Target
updates/Uninstall/unins000.exe
-
Size
1.5MB
-
MD5
3ab31d714c50ae078f9eaba7b2497191
-
SHA1
45c5e807e459d95618c03a6ded9debe1d70013f3
-
SHA256
4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
-
SHA512
f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
SSDEEP
24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe" /FIRSTPHASEWND=$B02682⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmpFilesize
1.5MB
MD53ab31d714c50ae078f9eaba7b2497191
SHA145c5e807e459d95618c03a6ded9debe1d70013f3
SHA2564f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
SHA512f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
memory/796-6-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/796-12-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/796-15-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/5000-0-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/5000-11-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB