Analysis

  • max time kernel
    68s
  • max time network
    102s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 22:04

General

  • Target

    base/uninst.exe

  • Size

    100KB

  • MD5

    812ceda63e8fb52f08d13a270f60064f

  • SHA1

    3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

  • SHA256

    d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

  • SHA512

    9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

  • SSDEEP

    3072:bgXdZt9P6D3XJbOpo2eAjEu5fiXEVgfo7M:be341OpTjEu5qXEVgfo7M

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • NSIS installer 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\base\uninst.exe
    "C:\Users\Admin\AppData\Local\Temp\base\uninst.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\base\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe
        "C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1756 -s 1188
          4⤵
          • Program crash
          PID:1104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    100KB

    MD5

    812ceda63e8fb52f08d13a270f60064f

    SHA1

    3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

    SHA256

    d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

    SHA512

    9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    100KB

    MD5

    812ceda63e8fb52f08d13a270f60064f

    SHA1

    3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

    SHA256

    d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

    SHA512

    9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

  • \Users\Admin\AppData\Local\Temp\nsy8789.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • \Users\Admin\AppData\Local\Temp\nsy8789.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

  • \Users\Admin\AppData\Local\Temp\nsy8789.tmp\nsProcess.dll

    Filesize

    4KB

    MD5

    05450face243b3a7472407b999b03a72

    SHA1

    ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

    SHA256

    95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

    SHA512

    f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    100KB

    MD5

    812ceda63e8fb52f08d13a270f60064f

    SHA1

    3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

    SHA256

    d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

    SHA512

    9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

  • memory/1104-67-0x0000000000000000-mapping.dmp

  • memory/1272-56-0x0000000000000000-mapping.dmp

  • memory/1600-54-0x0000000075601000-0x0000000075603000-memory.dmp

    Filesize

    8KB

  • memory/1756-63-0x0000000000000000-mapping.dmp

  • memory/1756-64-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/1756-65-0x0000000000270000-0x0000000000284000-memory.dmp

    Filesize

    80KB

  • memory/1756-66-0x00000000004B0000-0x0000000000518000-memory.dmp

    Filesize

    416KB