Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 13:36

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    a2a6e2fe649d7df57bc7c53c43b70d8d

  • SHA1

    8909dccd63e93d13be0d7d2d13fc18213cd2fce0

  • SHA256

    a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2

  • SHA512

    afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJLcpub3RsagxxZ/RL32/DB:8kjAJ4dDGkJ+AI0F8hsagjZ/RLm/1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi3D01.tmp\ioSpecial.ini

    Filesize

    610B

    MD5

    699d0e929c2972ccb32ce739e4119734

    SHA1

    e52e3b154c6d7bd21f7be5fd734f610c73cb5293

    SHA256

    5ed5b2e35e39edcadc84574513962c97f7a73119fece1f37c444ede4a3442b91

    SHA512

    2782ab1ced8f5ad7d754ba4b47d0c7b4471a27f3becec5bf4ddac872ca3443db2d2e5c1e7535724f9ddeebf4339c982b3c0e7e2ff40ce8a275c04afcbb5d4c8b

  • \Users\Admin\AppData\Local\Temp\nsi3D01.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • \Users\Admin\AppData\Local\Temp\nsi3D01.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    a2a6e2fe649d7df57bc7c53c43b70d8d

    SHA1

    8909dccd63e93d13be0d7d2d13fc18213cd2fce0

    SHA256

    a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2

    SHA512

    afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69