Analysis

  • max time kernel
    60s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2023 07:05

General

  • Target

    AppFuscator/unins000.exe

  • Size

    2.5MB

  • MD5

    61859891f371ac2ce1c892f3baae796b

  • SHA1

    26cfd62d65cb12608d0ac5d56b2d4b7b8045c591

  • SHA256

    c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e

  • SHA512

    d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e

  • SSDEEP

    49152:1R/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNa:b/jtYLP1Sy5E0p

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AppFuscator\unins000.exe
    "C:\Users\Admin\AppData\Local\Temp\AppFuscator\unins000.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\AppFuscator\unins000.exe" /FIRSTPHASEWND=$80182
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:1100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

    Filesize

    2.5MB

    MD5

    61859891f371ac2ce1c892f3baae796b

    SHA1

    26cfd62d65cb12608d0ac5d56b2d4b7b8045c591

    SHA256

    c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e

    SHA512

    d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e

  • C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

    Filesize

    2.5MB

    MD5

    61859891f371ac2ce1c892f3baae796b

    SHA1

    26cfd62d65cb12608d0ac5d56b2d4b7b8045c591

    SHA256

    c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e

    SHA512

    d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e

  • memory/1100-140-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/1100-142-0x0000000000400000-0x0000000000682000-memory.dmp

    Filesize

    2.5MB

  • memory/1100-143-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/1100-145-0x0000000000400000-0x0000000000682000-memory.dmp

    Filesize

    2.5MB

  • memory/5080-139-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/5080-141-0x0000000000400000-0x0000000000682000-memory.dmp

    Filesize

    2.5MB