f23044e2fd0574d7ec3d9e4674f916e0345088fa0d4ba7987d39284e3b858454

Analysis

max time kernel
105s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/uninstall.exe
Size

10.4MB
MD5

5cbbe8f43b1b8a30d95267b8aa0b54d3
SHA1

2e1af372b0e624f36095e79a1006feb6ac947557
SHA256

4c2ea3c709911a027600a5e2373dd458ac9f1e9907bbf9e829eae8a138c4d7a6
SHA512

f480405496a48bf1a9b0248134d379c9ab398722c3fa1115ecb90787b30c0c84664aef4c7ea2737cdb5f8a51ba460452e88ce7c366b13da7de28a45116cb6ebb
SSDEEP

196608:thKt9oJK9F9Qm4aEWVHKJmk1Sw/JfbA2q/kAp8mbrbrID:thK/7im4fkYS8fJqZ84E

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	uninstall.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	un.exe

Loads dropped DLL 9 IoCs

pid	Process
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	uninstall.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	uninstall.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe
1208	uninstall.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	un.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1172	1208	uninstall.exe	85
PID 1208 wrote to memory of 1172	1208	uninstall.exe	85
PID 1208 wrote to memory of 1172	1208	uninstall.exe	85
PID 1172 wrote to memory of 3652	1172	cmd.exe	87
PID 1172 wrote to memory of 3652	1172	cmd.exe	87
PID 1172 wrote to memory of 3652	1172	cmd.exe	87
PID 1208 wrote to memory of 3012	1208	uninstall.exe	88
PID 1208 wrote to memory of 3012	1208	uninstall.exe	88
PID 1208 wrote to memory of 3012	1208	uninstall.exe	88

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"DF371255\",\"events\":[{\"name\":\"Uninstall_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-ar-mutaz\",\"install_trackversion\":\"2.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=vT2-CR2mSpKugIO5e8H3pQ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\curl.exe
    curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"DF371255\",\"events\":[{\"name\":\"Uninstall_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-ar-mutaz\",\"install_trackversion\":\"2.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=vT2-CR2mSpKugIO5e8H3pQ"
    3⤵
    PID:3652
- C:\Users\Admin\AppData\Local\Temp\un.exe
  "C:\Users\Admin\AppData\Local\Temp\un.exe" """av:2.0.1" "gv:2.0.1.1" "gs:Official-ar-mutaz" "gi:UA-85655135-16" "an:AnyUnlock - iPhone Password Unlocker" "c:iMobie"""
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\CheckProVs.dll

Filesize
7KB

MD5
62e85098ce43cb3d5c422e49390b7071

SHA1
df6722f155ce2a1379eff53a9ad1611ddecbb3bf

SHA256
ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2

SHA512
dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\GoogleTracingLib.dll

Filesize
36KB

MD5
d8fca35ff95fe00a7174177181f8bd13

SHA1
fbafea4d2790dd2c0d022dfb08ded91de7f5265e

SHA256
ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c

SHA512
eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\SkinBtn.dll

Filesize
4KB

MD5
29818862640ac659ce520c9c64e63e9e

SHA1
485e1e6cc552fa4f05fb767043b1e7c9eb80be64

SHA256
e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb

SHA512
ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu5257.tmp\un.exe

Filesize
10.8MB

MD5
7694ce9cf9eb6fbcd0fcbb4da9b0fb8c

SHA1
ecbdf069dab0ebf11c9c2ddb7df3f00ea907ec25

SHA256
ef3786690271a86d00c1e3de7eb2bd3c14cd389ee8cb65505873508f58cbf306

SHA512
2076e3428cc1685b8721a8f6b964c0fad68e79d2af56b54a03b0ce388cc799f8433205b7b56f71a3e9359ab3da708d3d64f92ba9663ac4d84ed605b277f76fdd

Download Submit
memory/1208-36-0x0000000003490000-0x00000000034E9000-memory.dmp

Filesize
356KB

Download
memory/3012-68-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/3012-73-0x0000000009710000-0x0000000009A64000-memory.dmp

Filesize
3.3MB

Download
memory/3012-66-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3012-69-0x0000000006080000-0x00000000060E6000-memory.dmp

Filesize
408KB

Download
memory/3012-70-0x0000000006DF0000-0x0000000006E4A000-memory.dmp

Filesize
360KB

Download
memory/3012-71-0x0000000007270000-0x0000000007290000-memory.dmp

Filesize
128KB

Download
memory/3012-72-0x0000000007590000-0x0000000007598000-memory.dmp

Filesize
32KB

Download
memory/3012-67-0x0000000000A80000-0x000000000155C000-memory.dmp

Filesize
10.9MB

Download
memory/3012-74-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/3012-75-0x0000000006FA0000-0x0000000006FA8000-memory.dmp

Filesize
32KB

Download
memory/3012-76-0x000000000B640000-0x000000000B678000-memory.dmp

Filesize
224KB

Download
memory/3012-77-0x0000000009E60000-0x0000000009E6E000-memory.dmp

Filesize
56KB

Download
memory/3012-78-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3012-79-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/3012-80-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download