17fa74b386cd22e47ceb8f48b958cf99865985ec6bbb1786f1c62fc3f804bccb

Analysis

max time kernel
898s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/tools/RevoUninstaller.exe
Size 20.8MB
Sample260816-jsc9bsshpa
SHA256 17fa74b386cd22e47ceb8f48b958cf99865985ec6bbb1786f1c62fc3f804bccb
MD5 a48a4f7ced6fb636ec62eca2eab90678
SHA1 c26e2d0f3d984187a1a8d05772dae7f243a7f84b
SHA512 248fe9084aaa7e00865699fd089060348a14d803e5bc121f3fad3b41693f8620eaebae6805a9ecdd547211919c831ae0521e360b3f55e2b551fff6345243c50e
SSDEEP 196608:4RYn3XUAe1ELJhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIef:4RYn3XUA/JhlqPWpyR1pxf
TLSH
T13C2719B2DA1584CCEE6C6675CE1D89FDDEA26C1AAFA089AF41043D11ED732C09D3D24D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	RevoUninstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe
4000	RevoUninstaller.exe

C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\RevoUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\RevoUninstaller.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\TraceX Final\settings.ini
Size 516B
SHA256 9f5fbb1ea002992bb0d6f565c8ce97e8adc8e5232b8a5b186b5f0ad172d58e82
MD5 8748c6ad160ede6bb666c5d7805050c8
SHA1 f05f6e98f7fe2541679f26ea1c6d2b2fac9e7269
SHA512 d93586f97526f58c31505a8f9048908feb122146687cb3941e792db520cf29908e3b05450eadfa6fe7fb72540717814ab1aac3ae542704eddc7dabb82bd2de69
TLSH
T10BF0E52727F4315CF2F76718EA7994702735BC20563EC98C52E0110D09F4640A6567F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\TraceX Final\settings.ini
Size 624B
SHA256 8c69be3c92fd9059ba086ddf5217665dbd1557cd1a71605e957f509bfc37f82b
MD5 407791080b8e1fd35807748847ec2ccd
SHA1 821642012c911c541c91f31f8754665cb40a6fab
SHA512 0327be530bae1cf25180b1f93a25829975c70011e3c3667ea6a366a87a4e5d42c3aa0f6503e4d3162c9a265ea615693bdddf2db963d2dbb94f242957aaebf7cb
TLSH
T1F6F0B4272BF43068F2F36754EA7854712B35BC10563DC58C92D0010D08F4581F5567F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\TraceX Final\settings.ini
Size 1020B
SHA256 a42eeeb9617954442b3667834503e5be5981eada9ad42871ecd507680b40c915
MD5 4a43aa621a48ff7f57d5b659677e04ee
SHA1 4b6f0e34e79a714afe9a120a1bdf6de1489e6a29
SHA512 a76339a9c12e24c0af78874400d69d5ff14c26c20e699f92d48810428e0ffdbd7a33e37abf0a353f7494743188b70cd65481a2ddd16350a71d60bbffef360724
TLSH
T1D511E5636BF82058F2F35B58FE7964711B767C512E38C98C43E0010C09F5680E162BB7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\TraceX Final\settings.ini
Size 1KB
SHA256 3379f7f1579a6d5f69f994c955b95abcbde1a8a9f5141793b63e63076f58fc74
MD5 2a1757921f7271849f25adb687cad18f
SHA1 1d51c50f66c072dbe4719908065f4cec08d3706d
SHA512 105ee7f284e65d4ab7639ba37fb7af68f564cd5cbd2b609642f019723c2933f31b59e544f65c4589cf7b738dfbb5b9e96a3c0c594f98e63c5d9fad9c9a7139cc
TLSH
T16711BF676BF82058F2F36B68FEB9A4712B767C512A38C98C43D0010C09F5681E566BB7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\TraceX Final\settings.ini
Size 1KB
SHA256 f36c5c71f3290c50f6db11bcd7dc73c721b81c470e607725f6e5ac43eb8b0d60
MD5 f3243a864cdaf0559f4862ad9edd07fc
SHA1 b84f466ec9c6b1814c863ecd7847a09893709f41
SHA512 ceb2b19173cc18189812ca2f3477df6efe9520edc14bd9abe06db388ca7023700c52096b5ed9f6c0368f16b4139155fbfc955ed61e0d6eed58061f4e52bd3308
TLSH
T16421BE676BF82058F2F36B58FEB8A4711B767C512A38C98C42D0010C08F5681E062BB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads