f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe.nsis
Size

1KB
MD5

2141b8e262a0f16789a1b82887dd12e9
SHA1

c3b13403aa98dda3b5b77cc217cf21ef7c61b0ca
SHA256

a7616bce17b4cb966aeb8db7db1d991321890a7aa1ec54eaa10c62ad153bb2b0
SHA512

17a6cf392e25dd192658410e1ba1f5a112974d493141c3bbb2bed7f7f5f883c147ccf8cf3d8bbcc3df82b7e45dde2370fd85ee513241bb7199eb6d5aa4e82ba8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.nsis	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.nsis\ = "nsis_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\nsis_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2880	2740	cmd.exe	29
PID 2740 wrote to memory of 2880	2740	cmd.exe	29
PID 2740 wrote to memory of 2880	2740	cmd.exe	29
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\uninst.exe.nsis
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\uninst.exe.nsis
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\uninst.exe.nsis"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5be87d78da6d24de4dae163747b1fa50

SHA1
5f9df9b2b92be8f96fd5d4f4d8a1aadd2c41baf1

SHA256
a76067c81d7e373bf88467649a758c120a027670b86dfc0fb29eaf01d8fcac29

SHA512
28800bd43a115f957ba54c76eb96a18465955573b639eb68cbe42026d8f692000c3e45154beb984d6bde17e412e9bf6f0a38e1b8df1122f1b1b9ec73ecbb97cf

Download Submit