Analysis
- max time kernel
121s - max time network
126s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
05/07/2024, 16:18
General
- Target updates/Uninstall/unins000.exe
- Size 1.5MB
- Sample240705-tsahjs1flk
- SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe" /FIRSTPHASEWND=$9014C2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_iu14D2N.tmp
_shfoldr.dll
memory/2788-5-0x0000000000240000-0x0000000000241000-memory.dmp
memory/2788-15-0x0000000000400000-0x000000000057D000-memory.dmp
memory/2928-8-0x0000000000250000-0x0000000000251000-memory.dmp
memory/2928-16-0x0000000000400000-0x000000000057D000-memory.dmp
memory/2928-19-0x0000000000400000-0x000000000057D000-memory.dmp