Analysis
- max time kernel
88s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20240704-en - resource tags
- submitted
05/07/2024, 16:18
General
- Target updates/Uninstall/unins000.exe
- Size 1.5MB
- Sample240705-tsahjs1flk
- SHA256 4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\updates\Uninstall\unins000.exe" /FIRSTPHASEWND=$A022E2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_iu14D2N.tmp
memory/4164-6-0x0000000002370000-0x0000000002371000-memory.dmp
memory/4164-12-0x0000000000400000-0x000000000057D000-memory.dmp
memory/4164-15-0x0000000000400000-0x000000000057D000-memory.dmp
memory/4924-0-0x0000000002730000-0x0000000002731000-memory.dmp
memory/4924-11-0x0000000000400000-0x000000000057D000-memory.dmp