Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 08:12
Behavioral task
behavioral1
Sample
Uninstalr_Portable.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target Uninstalr_Portable.exe
- Size 7.1MB
- Sample260720-j3yysady2x
- SHA256 2eb88a7c5396c486e4d2bb81490a02d62dddf2e3273b5a805a9629aaad82bf7c
- MD5 17b4b52e9d13233fb196f960ccd4395c
- SHA1 6739ed1f9ca64cafe211b188a148951f1bd31772
- SHA512 e3252518e9729943a3378f41ce58971d298177c8e921596a6e9e8146f96334f7398522fa7c14756ace5109c0a790649b0a5227c4bbbe569da7eeafee24df4740
- SSDEEP 98304:vFlZpRJPMAg5DxfP3DxugoLFkz2vxmZ5bHU8mJUlR01xM3O90gXXBT+geku:dblg5lfP3DxugoFkMmZ9H7mJM0oeCgKh
- TLSH T197763392DA0B14DBC42A8D3C2386ED9AC5953F7A4BC52F6C614EF96E7032F91EC70506
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: Uninstalr_Portable.exe File opened (read-only) \??\x: Uninstalr_Portable.exe File opened (read-only) \??\J: Uninstalr_Portable.exe File opened (read-only) \??\L: Uninstalr_Portable.exe File opened (read-only) \??\o: Uninstalr_Portable.exe File opened (read-only) \??\v: Uninstalr_Portable.exe File opened (read-only) \??\U: Uninstalr_Portable.exe File opened (read-only) \??\Y: Uninstalr_Portable.exe File opened (read-only) \??\Z: Uninstalr_Portable.exe File opened (read-only) \??\O: Uninstalr_Portable.exe File opened (read-only) \??\P: Uninstalr_Portable.exe File opened (read-only) \??\i: Uninstalr_Portable.exe File opened (read-only) \??\z: Uninstalr_Portable.exe File opened (read-only) \??\B: Uninstalr_Portable.exe File opened (read-only) \??\I: Uninstalr_Portable.exe File opened (read-only) \??\d: Uninstalr_Portable.exe File opened (read-only) \??\k: Uninstalr_Portable.exe File opened (read-only) \??\t: Uninstalr_Portable.exe File opened (read-only) \??\Q: Uninstalr_Portable.exe File opened (read-only) \??\p: Uninstalr_Portable.exe File opened (read-only) \??\q: Uninstalr_Portable.exe File opened (read-only) \??\r: Uninstalr_Portable.exe File opened (read-only) \??\S: Uninstalr_Portable.exe File opened (read-only) \??\T: Uninstalr_Portable.exe File opened (read-only) \??\W: Uninstalr_Portable.exe File opened (read-only) \??\g: Uninstalr_Portable.exe File opened (read-only) \??\n: Uninstalr_Portable.exe File opened (read-only) \??\y: Uninstalr_Portable.exe File opened (read-only) \??\A: Uninstalr_Portable.exe File opened (read-only) \??\G: Uninstalr_Portable.exe File opened (read-only) \??\H: Uninstalr_Portable.exe File opened (read-only) \??\K: Uninstalr_Portable.exe File opened (read-only) \??\M: Uninstalr_Portable.exe File opened (read-only) \??\R: Uninstalr_Portable.exe File opened (read-only) \??\N: Uninstalr_Portable.exe File opened (read-only) \??\V: Uninstalr_Portable.exe File opened (read-only) \??\X: Uninstalr_Portable.exe File opened (read-only) \??\a: Uninstalr_Portable.exe File opened (read-only) \??\j: Uninstalr_Portable.exe File opened (read-only) \??\l: Uninstalr_Portable.exe File opened (read-only) \??\u: Uninstalr_Portable.exe File opened (read-only) \??\w: Uninstalr_Portable.exe File opened (read-only) \??\D: Uninstalr_Portable.exe File opened (read-only) \??\b: Uninstalr_Portable.exe File opened (read-only) \??\h: Uninstalr_Portable.exe File opened (read-only) \??\m: Uninstalr_Portable.exe -
resource yara_rule behavioral2/memory/3392-0-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-8-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-9-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-16-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-17-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-18-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-19-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-20-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-21-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-22-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-23-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-24-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-25-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-26-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-27-0x0000000000D60000-0x0000000003512000-memory.dmp upx behavioral2/memory/3392-28-0x0000000000D60000-0x0000000003512000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5408 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstalr_Portable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3976 WMIC.exe 3976 WMIC.exe 3976 WMIC.exe 3976 WMIC.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe 3392 Uninstalr_Portable.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3976 WMIC.exe Token: SeSecurityPrivilege 3976 WMIC.exe Token: SeTakeOwnershipPrivilege 3976 WMIC.exe Token: SeLoadDriverPrivilege 3976 WMIC.exe Token: SeSystemProfilePrivilege 3976 WMIC.exe Token: SeSystemtimePrivilege 3976 WMIC.exe Token: SeProfSingleProcessPrivilege 3976 WMIC.exe Token: SeIncBasePriorityPrivilege 3976 WMIC.exe Token: SeCreatePagefilePrivilege 3976 WMIC.exe Token: SeBackupPrivilege 3976 WMIC.exe Token: SeRestorePrivilege 3976 WMIC.exe Token: SeShutdownPrivilege 3976 WMIC.exe Token: SeDebugPrivilege 3976 WMIC.exe Token: SeSystemEnvironmentPrivilege 3976 WMIC.exe Token: SeRemoteShutdownPrivilege 3976 WMIC.exe Token: SeUndockPrivilege 3976 WMIC.exe Token: SeManageVolumePrivilege 3976 WMIC.exe Token: 33 3976 WMIC.exe Token: 34 3976 WMIC.exe Token: 35 3976 WMIC.exe Token: 36 3976 WMIC.exe Token: SeIncreaseQuotaPrivilege 3976 WMIC.exe Token: SeSecurityPrivilege 3976 WMIC.exe Token: SeTakeOwnershipPrivilege 3976 WMIC.exe Token: SeLoadDriverPrivilege 3976 WMIC.exe Token: SeSystemProfilePrivilege 3976 WMIC.exe Token: SeSystemtimePrivilege 3976 WMIC.exe Token: SeProfSingleProcessPrivilege 3976 WMIC.exe Token: SeIncBasePriorityPrivilege 3976 WMIC.exe Token: SeCreatePagefilePrivilege 3976 WMIC.exe Token: SeBackupPrivilege 3976 WMIC.exe Token: SeRestorePrivilege 3976 WMIC.exe Token: SeShutdownPrivilege 3976 WMIC.exe Token: SeDebugPrivilege 3976 WMIC.exe Token: SeSystemEnvironmentPrivilege 3976 WMIC.exe Token: SeRemoteShutdownPrivilege 3976 WMIC.exe Token: SeUndockPrivilege 3976 WMIC.exe Token: SeManageVolumePrivilege 3976 WMIC.exe Token: 33 3976 WMIC.exe Token: 34 3976 WMIC.exe Token: 35 3976 WMIC.exe Token: 36 3976 WMIC.exe Token: SeSecurityPrivilege 3832 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3392 Uninstalr_Portable.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3392 Uninstalr_Portable.exe 3832 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3392 wrote to memory of 5408 3392 Uninstalr_Portable.exe 92 PID 5408 wrote to memory of 3976 5408 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstalr_Portable.exe"C:\Users\Admin\AppData\Local\Temp\Uninstalr_Portable.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic product get InstallDate, InstallLocation, Name, Vendor, Version > "C:\Users\Admin\AppData\Local\Temp\Uninstalr\Uninstalr_can_delete_x2_240721578.tmp"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic product get InstallDate, InstallLocation, Name, Vendor, Version3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3832