3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:19

Target

uninstall.exe
Size

139KB
MD5

4f009883567dfa9e908c5ffa25a2fa0a
SHA1

5848783144c5a04fd4fff71651e3195444156b03
SHA256

d0b0305b42c35716482a6aa08c8257c19aad225e3ffd9ab1f0de411d8b9e592e
SHA512

015e03849ccb6f646538ebb5a1f75bd973258564a4d2664f51da11e88316e9a3d2863de131f105daf2173a5c494e6c6bcc621c6952144ed4bf4bd2bbdec5ef6d
SSDEEP

3072:cAe+3aJpgWXTBuA/JFONMVRO9qyVK+J5n/79:/B+pgUXJFOSVAqyVK+J5nj9

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

2156 Un_A.exe
Loads dropped DLL 2 IoCs

Processes:

uninstall.exeUn_A.exe

pid process

1620 uninstall.exe
2156 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Un_A.exe

pid process

2156 Un_A.exe

pid	process
2156	Un_A.exe

pid	process
1620	uninstall.exe
2156	Un_A.exe

pid	process
2156	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 1620 wrote to memory of 2156	1620	uninstall.exe	Un_A.exe
PID 1620 wrote to memory of 2156	1620	uninstall.exe	Un_A.exe
PID 1620 wrote to memory of 2156	1620	uninstall.exe	Un_A.exe
PID 1620 wrote to memory of 2156	1620	uninstall.exe	Un_A.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst8835.tmp\LangDLL.dll

Filesize
5KB

MD5
0c44f21d4afc81cc99fac7cc35e4503a

SHA1
3d0d5c684df99a46510c0e2c0020163a9d11c08d

SHA256
8dc2be6679497994e3ddc97bc7bc1ce2b3c17ef3528b03ded6696ef198a11d10

SHA512
4e4bd35d6aa21cecbfe7a93a2ee7db8ee78ca710a4193dfe240d1067afbe10f61db332c1c85f6cc3ba404d895a959742401b615ef8ff5bd9028254c4a43a0923

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
139KB

MD5
4f009883567dfa9e908c5ffa25a2fa0a

SHA1
5848783144c5a04fd4fff71651e3195444156b03

SHA256
d0b0305b42c35716482a6aa08c8257c19aad225e3ffd9ab1f0de411d8b9e592e

SHA512
015e03849ccb6f646538ebb5a1f75bd973258564a4d2664f51da11e88316e9a3d2863de131f105daf2173a5c494e6c6bcc621c6952144ed4bf4bd2bbdec5ef6d

Download Submit