Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
02-07-2024 17:59
General
-
Target
update/Uninstall/unins000 — копия (13) — копия.exe
-
Size
1.5MB
-
MD5
3ab31d714c50ae078f9eaba7b2497191
-
SHA1
45c5e807e459d95618c03a6ded9debe1d70013f3
-
SHA256
4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
-
SHA512
f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
SSDEEP
24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKMrexLxB:cIEJxCWluyZ8UbMZz
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\update\Uninstall\unins000 — копия (13) — копия.exe"C:\Users\Admin\AppData\Local\Temp\update\Uninstall\unins000 — копия (13) — копия.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\update\Uninstall\unins000 — копия (13) — копия.exe" /FIRSTPHASEWND=$C014E2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\_iu14D2N.tmpFilesize
1.5MB
MD53ab31d714c50ae078f9eaba7b2497191
SHA145c5e807e459d95618c03a6ded9debe1d70013f3
SHA2564f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb
SHA512f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae
-
\Users\Admin\AppData\Local\Temp\is-61LAR.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/2128-7-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2128-18-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/2672-0-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2672-15-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB