debf351be78e09aba6a74dd649077d4b7ed011f244b6e0e0ab3c75577828862f

Analysis

max time kernel
0s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstaller.exe
Size

494KB
MD5

f50c3caca9359145759d59af529dc537
SHA1

ad42e0494b1f98cba61806c3fb0a8a71a0db6ede
SHA256

00feb53d790da059e6863c3c45a062fc4038d72b079ab642ce9fd0e37f4dce7e
SHA512

07c7e0c089673da2be8aafe22cb975a8834fb365f8034bd7676b99e838995b9465fb5d20bc470ef95544985ba2583d135a44a6e7ee8dfa758135f625fe540ba5
SSDEEP

3072:dS17XJiDxmJ+0IyUlgE5UQ3MHJL10j68+zFgE7s6u15LUPFg0z23k3DCLuIyvQ31:dGiHl7eQ3C5xPFgjc1SB/Njz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3912	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3912	2748	uninstaller.exe	18
PID 2748 wrote to memory of 3912	2748	uninstaller.exe	18
PID 2748 wrote to memory of 3912	2748	uninstaller.exe	18

C:\Users\Admin\AppData\Local\Temp\uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\uninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...