Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08/07/2024, 21:15
General
-
Target
Uninstall Wheel of Fortune.exe
-
Size
59KB
-
MD5
9bba69417cd467c3b4c2b5375f4f0357
-
SHA1
cb600e6634eb7cc2ff9a70194c1f5931edb48647
-
SHA256
e2ebe962a7e317961e3cbc4f96cf5ac57ec03e6745f1dbbb6d5ed9e2b577f5ee
-
SHA512
65964da9a15a550c9c99e43f9ec6ed434eabd03749050c16193521119d4f0cdc6031a7357b0392c36ae68a57ca14da3ec57ddabdafe766380cf68700558f9f56
-
SSDEEP
1536:wG0Db1wJdBREzA01xVubM8JMLeAyBdgsgmimq7:cDb1wHBe6bM8JgeA4CsI7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
NSIS installer 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe"C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD59bba69417cd467c3b4c2b5375f4f0357
SHA1cb600e6634eb7cc2ff9a70194c1f5931edb48647
SHA256e2ebe962a7e317961e3cbc4f96cf5ac57ec03e6745f1dbbb6d5ed9e2b577f5ee
SHA51265964da9a15a550c9c99e43f9ec6ed434eabd03749050c16193521119d4f0cdc6031a7357b0392c36ae68a57ca14da3ec57ddabdafe766380cf68700558f9f56
-
Filesize
4KB
MD5419d642fe3436fda8bb22eea9c37a6ca
SHA1c1644131b880c6e03f14de3c79efd27093a77908
SHA25625c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7
SHA51229df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337
-
Filesize
4KB
MD58bb77ed61759966728b7cb065e0081ee
SHA1b2f1407daf21b301abea7a20cdb7fd181e3ff042
SHA256ab5496eef3b68e865ef79bca1a88813876589d7d63bc76808d6df38a88eaeb80
SHA512419541ad425373dab928f00e60bf83b19d53268e6d151d467a13dfabdb7a6a179b93c3f51c7fce394b062d619fdfcac587e3c7110ce1582c9d5e7ef85ec4cdf3