368d34d78d1e4d0c9992d275bee1bbcb3cc666065736eb557856abcafb6632a0

Analysis

max time kernel
148s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UninstallTool.exe
Size

3.8MB
MD5

549cad827392688fef8ca1bcdefb0826
SHA1

0607cd4d03eed12e3f618726c8d1f01f7ebbebde
SHA256

64afe4ed17923ad0b725cf211070917a2f34187fd5c41368613e7f66fa70ea53
SHA512

be1ac10947214e8e74cb4019f833d83123b7761871145114096dae119b9168f6c2befa8d5b93bfee9ec860eeb4b61e6ead6d27772f290a026f2bc52015d9c0e4
SSDEEP

98304:GVc0LpMg4XClaaJxsMws0F7xioOU2baMy2yoh:mdpua/sMBk2Jyoh

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	UninstallTool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1096	UninstallTool.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	UninstallTool.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe
1096	UninstallTool.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28
PID 1096 wrote to memory of 1492	1096	UninstallTool.exe	28

C:\Users\Admin\AppData\Local\Temp\UninstallTool.exe
"C:\Users\Admin\AppData\Local\Temp\UninstallTool.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\UninstallToolHelper.exe
  C:\Users\Admin\AppData\Local\Temp\UninstallToolHelper.exe
  2⤵
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x00000000039A0000-0x0000000003A14000-memory.dmp

Filesize
464KB

Download
memory/1492-57-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download