Overview

overview

8

Static

static

3

Revo.Unins....0.exe

windows7-x64

8

Revo.Unins....0.exe

windows10-2004-x64

7

$EXEDIR/Re...xt.dll

windows7-x64

7

$EXEDIR/Re...xt.dll

windows10-2004-x64

7

$EXEDIR/Re...ar.exe

windows7-x64

1

$EXEDIR/Re...ar.exe

windows10-2004-x64

1

$EXEDIR/Re...md.exe

windows7-x64

6

$EXEDIR/Re...md.exe

windows10-2004-x64

6

$EXEDIR/Re...ro.exe

windows7-x64

1

$EXEDIR/Re...ro.exe

windows10-2004-x64

1

$EXEDIR/Re...lt.sys

windows7-x64

1

$EXEDIR/Re...lt.sys

windows10-2004-x64

1

$EXEDIR/Re...lt.sys

windows10-2004-x64

1

$EXEDIR/Re...lt.sys

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

RUExt.dll

windows7-x64

7

RUExt.dll

windows10-2004-x64

7

RevoAppBar.exe

windows7-x64

1

RevoAppBar.exe

windows10-2004-x64

1

RevoCmd.exe

windows7-x64

6

RevoCmd.exe

windows10-2004-x64

6

RevoUnPro.exe

windows7-x64

1

RevoUnPro.exe

windows10-2004-x64

1

Vista/revoflt.sys

windows7-x64

1

Vista/revoflt.sys

windows10-2004-x64

1

Win10/revoflt.sys

windows10-2004-x64

1

revoflt.sys

windows10-2004-x64

1

Analysis

  • max time kernel
    53s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 15:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Revo.Uninstaller.Pro.v5.3.0.exe

  • Size

    20.7MB

  • MD5

    ab260bfafed128f7519aaca44e8482da

  • SHA1

    ccef21b5db0834698fc75d2b9f249e298bc050b5

  • SHA256

    72a070524c85666844ca7ee14f2e9280faabda2664dcc3bfde927ac67c66fc61

  • SHA512

    33ec4e2f8cefaf1e523dc1d705576ad04c74df4d3ed3aee4f6d4cf4ef83f24ee862dfc30552a0219109fa1548a10c31ce2310a418593013537d56cba6c122f3a

  • SSDEEP

    393216:6v24Hctnm9hV2y4dl7IAo+hZNPCX+O/3/qDAtrBbx/jasTuYBnTJ/tlfkBaEUUE+:6HHHV/4dlDo+hL4+OvSDQFxmsTuY1TJW

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 18 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Revo.Uninstaller.Pro.v5.3.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Revo.Uninstaller.Pro.v5.3.0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Windows\system32\RUNDLL32.EXE
      RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
      2⤵
      • Drops file in Drivers directory
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\system32\runonce.exe
        "C:\Windows\system32\runonce.exe" -r
        3⤵
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\System32\grpconv.exe
          "C:\Windows\System32\grpconv.exe" -o
          4⤵
            PID:1804
      • C:\Windows\system32\regsvr32.exe
        regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
        2⤵
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Modifies registry class
        PID:2196
      • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
        "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2368
      • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
        "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1644
      • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
        "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1824
    • C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe
      C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
      Filesize

      187KB

      MD5

      8b9964e06195fd375d126b424e236f03

      SHA1

      6f1741cfeb9fb70c34857dbba3e063c88c3c32fa

      SHA256

      bda04b693bfdea86a7a3b47f2e4ceae9cd9475c4e81b0aa73b70fd244a65f70f

      SHA512

      741019523b4c5f4ef9a7952172309b2d304a84cbd98fff99a719105cc1938157edb1691554a21b9dcd2b523c0f1ab0d37879deefc3b2fa5579c0d8c76cade483

      Download Submit

    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
      Filesize

      123KB

      MD5

      00d7babcb1fca39669a305acc4e6bc4e

      SHA1

      caa71de90128acf6e8d812e02aa8ba4622bf8454

      SHA256

      f0f1890de8a60f87297d6de21146977060a3b5d82e09523bced0c238e94f5d2e

      SHA512

      9f1348f6ee7325b7d3381865bda4d71807da45c941c3b40c7671df04a6558832dfd03f25f5664250b43b641117d7d3d7c71f7e81b747cbc559fc5b8169033f66

      Download Submit

    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
      Filesize

      2KB

      MD5

      edc78deb34de240c787b1011161e9a4e

      SHA1

      2d31275530dce33d3bc329991c8ad59e1b303577

      SHA256

      69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b

      SHA512

      e55eefcc39b7353ef11a778910400c5c85cab9657bb350840988cbbf556dc343a9c1803442643c9255c149f8d93a5c2d2e6c3bea244f67c895e635eaec0a0f7b

      Download Submit

    • C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro5.lic
      Filesize

      64KB

      MD5

      8462a9b69c76a9603a4143d51fbc201e

      SHA1

      4473590f93f94f22c340a354516191c3c0ba6532

      SHA256

      fe4bcb4251f77375119a936c80fb36221af0c5105e840e2e115d47f96cb437c8

      SHA512

      2f02ecdb06760a093f4d8e6f04c97138695b064db8cb2dcc4af9b47c829852f38b77be9425eb2f3e3e36f85da181c116c829921fa35ae68afc57c728d5393570

      Download Submit

    • C:\Users\Admin\AppData\Local\VS Revo Group\Revo Uninstaller Pro\logFile.vslog
      Filesize

      322B

      MD5

      e32c4fd63407af1dff945c224dfbea41

      SHA1

      3f483e5afa254a00d7fd53ce354035734e75485f

      SHA256

      99eb46656ea293fb42425b47a007134389e395d48aec17f5dfd83188280120fa

      SHA512

      e077c3c04cb0399c7ed96d8b7913d194ae25cbfffdd1be0aea67fc9f88b0e2228ba2883ffd4fbeb78a060bb04062cb8fd5f1965b77862004ab8d144b1ed1c615

      Download Submit

    • C:\Windows\System32\drivers\revoflt.sys
      Filesize

      46KB

      MD5

      0006295c6c5f7fad92484785b9c8fac6

      SHA1

      7e50c90a91b92f943e951c1cd8809fe12fc75cc0

      SHA256

      4ba2879f2b82978110e4b3940ebfeb2ca2399660b0627998c6fea0bf33603b62

      SHA512

      37f02befaf3b988676af4e556cba142dfef78fd771d4c68f7744e92e789a5c1fd72afe2bb38e297e190f962a6ccf58c161f80bec2a7aacaf024256f25eb7bf03

      Download Submit

    • \Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
      Filesize

      24.2MB

      MD5

      c8c368988a2a4c2a953b7db4bca47961

      SHA1

      5acc29b51284146a9ff7b1587c3d89416e66acdf

      SHA256

      f680e0fe00a48f6e3d079c1572682d6664f476b119745d73cb852baba58cc683

      SHA512

      5fdef1f4e3b471910fe2b12f6f6aa8bfad3f2a9c80954843085c79139823a88e0c7d921b7c01dda56871800afc20de4739682c02e9fa6a94715c64207a671b30

      Download Submit

    • \Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe
      Filesize

      175KB

      MD5

      886796a33ecf9f4a224af23f57d26511

      SHA1

      43d83d0ca6130cb0666ed3c2137b9fd4eeabeeda

      SHA256

      0671aaf3da6b3dc70b9c9dc28700061d1bbc3c05b12d6ac106ee108a281b50d1

      SHA512

      998247a0ca973c81585168ee24035a595c33785bfddbc89fd3b0500402bd0eff7bf8241a2501525b89cadf7e6b0d07e452c3a8a64ceb3117dd8626ee69875527

      Download Submit

    • \Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
      Filesize

      9.6MB

      MD5

      216b49b7eb7be44d7ed7367f3725285f

      SHA1

      cf0776ecbc163c738fd43767bedcc2a67acef423

      SHA256

      c6d97857b3b9f26c8e93d7b6e6481f93a16db75cbf9d1756cb29fba0fd9e240e

      SHA512

      060fb76d91bee1b421f133cae17726a68adc97ddce76a67196d10e735e216d032bee939c905b847c50f29e859dca43cdf1b19e4ae349e00efe88147224d665cb

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsu2DE6.tmp\LangDLL.dll
      Filesize

      5KB

      MD5

      549ee11198143574f4d9953198a09fe8

      SHA1

      2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1

      SHA256

      131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36

      SHA512

      0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsu2DE6.tmp\System.dll
      Filesize

      12KB

      MD5

      192639861e3dc2dc5c08bb8f8c7260d5

      SHA1

      58d30e460609e22fa0098bc27d928b689ef9af78

      SHA256

      23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

      SHA512

      6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsu2DE6.tmp\nsDialogs.dll
      Filesize

      9KB

      MD5

      b7d61f3f56abf7b7ff0d4e7da3ad783d

      SHA1

      15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

      SHA256

      89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

      SHA512

      6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

      Download Submit

    • \Users\Admin\AppData\Local\Temp\nsu2DE6.tmp\nsExec.dll
      Filesize

      7KB

      MD5

      11092c1d3fbb449a60695c44f9f3d183

      SHA1

      b89d614755f2e943df4d510d87a7fc1a3bcf5a33

      SHA256

      2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

      SHA512

      c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

      Download Submit

    • memory/1644-195-0x0000000000400000-0x0000000000E32000-memory.dmp

      Filesize

      10.2MB

      Download

    • memory/3048-237-0x0000000000400000-0x0000000000E32000-memory.dmp

      Filesize

      10.2MB

      Download