Analysis
- max time kernel
131s - max time network
136s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
05/07/2024, 16:18
General
- Target updates/Uninstall/unins000.exe
- Size 1.5MB
- Sample240705-tsahjs1flk
- SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe" /FIRSTPHASEWND=$702002⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_iu14D2N.tmp
memory/2804-0-0x0000000000850000-0x0000000000851000-memory.dmp
memory/2804-11-0x0000000000400000-0x000000000057D000-memory.dmp
memory/4084-6-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/4084-12-0x0000000000400000-0x000000000057D000-memory.dmp
memory/4084-15-0x0000000000400000-0x000000000057D000-memory.dmp