5c28b949507a6330ec9e768251131e823e1ed1587b5e8913c9e70009f235e9bb

Analysis

max time kernel
68s
max time network
102s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base/uninst.exe
Size

100KB
MD5

812ceda63e8fb52f08d13a270f60064f
SHA1

3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244
SHA256

d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6
SHA512

9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8
SSDEEP

3072:bgXdZt9P6D3XJbOpo2eAjEu5fiXEVgfo7M:be341OpTjEu5qXEVgfo7M

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1272 Au_.exe
Loads dropped DLL 4 IoCs

Processes:

uninst.exeAu_.exe

pid process

1600 uninst.exe
1272 Au_.exe
1272 Au_.exe
1272 Au_.exe

pid	process
1272	Au_.exe

pid	process
1600	uninst.exe
1272	Au_.exe
1272	Au_.exe
1272	Au_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegisterUninstall.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FCcleaner = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FCcleaner.bat"	RegisterUninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1104 1756 WerFault.exe RegisterUninstall.exe

pid	pid_target	process	target process
1104	1756	WerFault.exe	RegisterUninstall.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Au_.exeRegisterUninstall.exe

pid process

1272 Au_.exe
1272 Au_.exe
1756 RegisterUninstall.exe
1756 RegisterUninstall.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegisterUninstall.exe

description pid process

Token: SeDebugPrivilege 1756 RegisterUninstall.exe

pid	process
1272	Au_.exe
1272	Au_.exe
1756	RegisterUninstall.exe
1756	RegisterUninstall.exe

description	pid	process
Token: SeDebugPrivilege	1756	RegisterUninstall.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

uninst.exeAu_.exeRegisterUninstall.exe

description	pid	process	target process
PID 1600 wrote to memory of 1272	1600	uninst.exe	Au_.exe
PID 1600 wrote to memory of 1272	1600	uninst.exe	Au_.exe
PID 1600 wrote to memory of 1272	1600	uninst.exe	Au_.exe
PID 1600 wrote to memory of 1272	1600	uninst.exe	Au_.exe
PID 1272 wrote to memory of 1756	1272	Au_.exe	RegisterUninstall.exe
PID 1272 wrote to memory of 1756	1272	Au_.exe	RegisterUninstall.exe
PID 1272 wrote to memory of 1756	1272	Au_.exe	RegisterUninstall.exe
PID 1272 wrote to memory of 1756	1272	Au_.exe	RegisterUninstall.exe
PID 1756 wrote to memory of 1104	1756	RegisterUninstall.exe	WerFault.exe
PID 1756 wrote to memory of 1104	1756	RegisterUninstall.exe	WerFault.exe
PID 1756 wrote to memory of 1104	1756	RegisterUninstall.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\base\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\base\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\base\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1756 -s 1188
      4⤵
      Program crash
      PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
100KB

MD5
812ceda63e8fb52f08d13a270f60064f

SHA1
3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

SHA256
d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

SHA512
9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
100KB

MD5
812ceda63e8fb52f08d13a270f60064f

SHA1
3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

SHA256
d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

SHA512
9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8789.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8789.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8789.tmp\nsProcess.dll

Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
100KB

MD5
812ceda63e8fb52f08d13a270f60064f

SHA1
3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244

SHA256
d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6

SHA512
9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8

Download Submit
memory/1104-67-0x0000000000000000-mapping.dmp

Download
memory/1272-56-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1756-63-0x0000000000000000-mapping.dmp

Download
memory/1756-64-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/1756-65-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1756-66-0x00000000004B0000-0x0000000000518000-memory.dmp

Filesize
416KB

Download