72a070524c85666844ca7ee14f2e9280faabda2664dcc3bfde927ac67c66fc61 | Triage

Analysis

max time kernel
14s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 15:30

Sharing

Report Analysis Logs

General

Target

RevoAppBar.exe
Size

9.3MB
MD5

8827e78b875bd9a2958a6008d6674c60
SHA1

f1d2a121d6cd2a7fab624f1e48226e2db151f6f4
SHA256

aabb2fa70f69a3a6f25c8652c1ad250dae818b0bb826b1bf7fea58c9caf67fa9
SHA512

f8d790731bd3f9bed85eec34c4e986f7b04efcc9b6f6bb8588bf11fbb0cc26640c78152ca97ad38ce424f756959b38b5c9b1128fc8f1c40c9e94a230fad86f1c
SSDEEP

98304:skOjtw8X57Q+FYXYzR1WTYmECaU4r2A0p/5chEuuZkJar:skOxw/QM5Ihbar

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
304	RevoAppBar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	304	RevoAppBar.exe
Token: SeLoadDriverPrivilege	304	RevoAppBar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
304	RevoAppBar.exe

C:\Users\Admin\AppData\Local\Temp\RevoAppBar.exe
"C:\Users\Admin\AppData\Local\Temp\RevoAppBar.exe"
1⤵
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\settings.ini

Filesize
39B

MD5
3390e11b3bc0368a09374b425bc9862f

SHA1
b1ac57944500154214f5088572863dae62462c48

SHA256
76b968ab5824efb28a57076cd84441ff5f533aac80e0441b90a27215055ccf44

SHA512
942585588d1476d3d5eb015702703a63fc862248b6109d1e50c1e631483c7fa7c0eb937b1e3ccebfa54338abb7625eb1eb3b13b77bcf1a5dc37a78a3c3969d53

Download Submit