Analysis

  • max time kernel
    136s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 13:36

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    a2a6e2fe649d7df57bc7c53c43b70d8d

  • SHA1

    8909dccd63e93d13be0d7d2d13fc18213cd2fce0

  • SHA256

    a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2

  • SHA512

    afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJLcpub3RsagxxZ/RL32/DB:8kjAJ4dDGkJ+AI0F8hsagjZ/RLm/1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsgFCB0.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • C:\Users\Admin\AppData\Local\Temp\nsgFCB0.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • C:\Users\Admin\AppData\Local\Temp\nsgFCB0.tmp\ioSpecial.ini

    Filesize

    610B

    MD5

    98f29b9efd00295b9fa65a3a1f8ac9e6

    SHA1

    da29b498694115ea9e9e5cd93054c724afa23f8e

    SHA256

    79c75f4fea73440ee56f78e5772571745ad383ff4fe5e97d4664024d67d95325

    SHA512

    e2e8c037b5aa434300c417111bb9e2ae003a28d32cc38c2ce7b3f6755bf6a0734b63f1156daa43b15051121b819b37746ce54f23ef65f2de4222b4c2a78d9e34

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    a2a6e2fe649d7df57bc7c53c43b70d8d

    SHA1

    8909dccd63e93d13be0d7d2d13fc18213cd2fce0

    SHA256

    a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2

    SHA512

    afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69