3b4fc2a2e594506881d82a8c418e9bcf572b3269dfab952f5ef70ea6a8838884

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RevoUninstaller_Portable/RevoUPort.exe
Size

200KB
MD5

2f814a927d097a09911111dbf0fc2e93
SHA1

8e4e953c60653a333182320345209765695d4e17
SHA256

ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf
SHA512

d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619
SSDEEP

3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RevoUPort.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe
5028	RevoUn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 5028	2416	RevoUPort.exe	84
PID 2416 wrote to memory of 5028	2416	RevoUPort.exe	84

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\RevoUPort.exe
"C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\RevoUPort.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe
  C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini

Filesize
3KB

MD5
e8dd6bfec9511bf1c31cb9c68a85b8b2

SHA1
daeb0a5890d9c35aaa3642ec4df1673e471b83c7

SHA256
cb7a03fbeef81ecfd4554adcff489ea4b1a0474b20acb6d94e601141c239c671

SHA512
05f60766afe6c12f708cb07aa1d3a57b5c21f7d0848bae655a495b4207d5d31c7af3ccb37ed0db34b1a9c5bbd139aadf0a077b46a75cedab56f0a5aaf525ddd6

Download Submit