Overview
overview
10Static
static
10hwid pack/...sk.exe
windows11-21h2-x64
6hwid pack/...up.exe
windows11-21h2-x64
1hwid pack/...RU.exe
windows11-21h2-x64
1hwid pack/...ll.exe
windows11-21h2-x64
1hwid pack/...rt.exe
windows11-21h2-x64
5hwid pack/...64.exe
windows11-21h2-x64
5hwid pack/...IN.exe
windows11-21h2-x64
1hwid pack/...64.exe
windows11-21h2-x64
1hwid pack/...16.exe
windows11-21h2-x64
hwid pack/...IT.exe
windows11-21h2-x64
1hwid pack/...LL.dll
windows11-21h2-x64
3hwid pack/...YS.sys
windows11-21h2-x64
1hwid pack/...64.sys
windows11-21h2-x64
1hwid pack/...64.sys
windows11-21h2-x64
1hwid pack/...lp.pdf
windows11-21h2-x64
1hwid pack/...rt.exe
windows11-21h2-x64
1hwid pack/...Un.exe
windows11-21h2-x64
6hwid pack/...Un.exe
windows11-21h2-x64
6hwid pack/...ew.chm
windows11-21h2-x64
1hwid pack/...ew.exe
windows11-21h2-x64
6Analysis
-
max time kernel
439s -
max time network
442s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 16:43
Behavioral task
behavioral1
Sample
hwid pack/HardDisk.exe
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
hwid pack/MacSetup.exe
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
hwid pack/monitor serial/CRU.exe
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
hwid pack/monitor serial/reset-all.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
hwid pack/monitor serial/restart.exe
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
hwid pack/monitor serial/restart64.exe
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
hwid pack/serial changer/AMIDEWIN.exe
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
hwid pack/serial changer/AMIDEWINx64.exe
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
hwid pack/serial changer/DMI16.exe
Resource
win11-20240611-en
Behavioral task
behavioral10
Sample
hwid pack/serial changer/DMIEDIT.exe
Resource
win11-20240611-en
Behavioral task
behavioral11
Sample
hwid pack/serial changer/UCOREDLL.dll
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
hwid pack/serial changer/UCORESYS.sys
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
hwid pack/serial changer/UCOREW64.sys
Resource
win11-20240611-en
Behavioral task
behavioral14
Sample
hwid pack/serial changer/amifldrv64.sys
Resource
win11-20240611-en
Behavioral task
behavioral15
Sample
hwid pack/uninstall/Revo Uninstaller Help.pdf
Resource
win11-20240508-en
Behavioral task
behavioral16
Sample
hwid pack/uninstall/RevoUPort.exe
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
hwid pack/uninstall/x64/RevoUn.exe
Resource
win11-20240508-en
Behavioral task
behavioral18
Sample
hwid pack/uninstall/x86/RevoUn.exe
Resource
win11-20240611-en
Behavioral task
behavioral19
Sample
hwid pack/usb device serial/USBDeview.chm
Resource
win11-20240611-en
Behavioral task
behavioral20
Sample
hwid pack/usb device serial/USBDeview.exe
Resource
win11-20240611-en
General
-
Target
hwid pack/uninstall/RevoUPort.exe
-
Size
200KB
-
MD5
2f814a927d097a09911111dbf0fc2e93
-
SHA1
8e4e953c60653a333182320345209765695d4e17
-
SHA256
ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf
-
SHA512
d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619
-
SSDEEP
3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
RevoUn.exepid process 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe -
Suspicious use of SendNotifyMessage 27 IoCs
Processes:
RevoUn.exepid process 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
RevoUn.exepid process 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe 4668 RevoUn.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
RevoUPort.exedescription pid process target process PID 2972 wrote to memory of 4668 2972 RevoUPort.exe RevoUn.exe PID 2972 wrote to memory of 4668 2972 RevoUPort.exe RevoUn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\RevoUPort.exe"C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\RevoUPort.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\x64\RevoUn.exe"C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\x64\RevoUn.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\REV9DB7.tmpFilesize
10KB
MD5b26a346eaf03ef14ee56a8b6eb98aa1e
SHA1f358ab0a8df9c739bfb9d0162e571a1c57a14459
SHA2568a6047754939db36ca953888c4e58bdcb6253edc23e6396e33b1f151e9f74c1f
SHA512deda2ee0040b44411a58809a00cebb14750e4668ed0c108e61dd08532f3326d504d8b0ff81ca1b1ce7a1999ce40a9f41ac3d56f85e51b1dca8e646e80fb3e991
-
C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\settings.iniFilesize
3KB
MD533c99957d82ae39b72f3784a51b58e01
SHA16c995c7b315bd25a488a7095a98067c68b834d04
SHA2564c461f5ec50bbb8ff2e2e991180f34405de4304e1e80a5b5bcfd35631e29b954
SHA51231a9a7e10abf3a2ba78dd6b5a53f535d7fce54281a690ca6f09ef2aad622246d69cdb198b892cb66b1a0cbca7a1cc278b0f24e349dcd9e0f833672d3b6fd3aeb
-
C:\Users\Admin\AppData\Local\Temp\hwid pack\uninstall\settings.iniFilesize
3KB
MD57c2eabc8cfc88df46b84012d1ab20cf0
SHA1253380087229013a4e0affc8cf84c08b8edcc97f
SHA256620babc36e5ace84cec0595835a5ea85a6674724bdee5eab6c3a81dc5c5da57a
SHA512968f72f21542139759539fc7f7da38a2a420b41ebf8519f7392695d60538aaa12e347dd33fd361ff2736ce29c4c9d30107501ab1d11c04ab15b6e005f5dad920