860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninst.exe
Size 38KB
Sample240304-ggf5qscc75
SHA256 e4443df1d3255cd1eb3fad89de5943341931f842498d327701dbefa7b00fa7c2
MD5 77d5904fb7d1c5a687b585b199f33828
SHA1 ae0ab177741d3900026b92ccf7abc211e9fd2e43
SHA512 579aa711970be9cd4116fb15cac3e9863d2fbfdccc35ca4711a28576ad3ab793daeea2b7d96e352ae6d98407a0354daf59c714f5faba341c6c4c3800e959ea33
SSDEEP 768:0w0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8JyJRngCY9aLyMW:0w0DsT0zikYCPMUxDRbw8JBx0o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
692	A~NSISu_.exe

Executes dropped EXE 1 IoCs

pid	Process
692	A~NSISu_.exe

Loads dropped DLL 1 IoCs

pid	Process
692	A~NSISu_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral22/files/0x000400000001e9a0-3.dat	nsis_installer_1

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4440	VwCfgNew.exe
1432	VwCfgNew.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 692	4904	uninst.exe	89
PID 4904 wrote to memory of 692	4904	uninst.exe	89
PID 4904 wrote to memory of 692	4904	uninst.exe	89
PID 692 wrote to memory of 4440	692	A~NSISu_.exe	95
PID 692 wrote to memory of 4440	692	A~NSISu_.exe	95
PID 692 wrote to memory of 4440	692	A~NSISu_.exe	95
PID 692 wrote to memory of 1432	692	A~NSISu_.exe	96
PID 692 wrote to memory of 1432	692	A~NSISu_.exe	96
PID 692 wrote to memory of 1432	692	A~NSISu_.exe	96

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Users\Admin\AppData\Local\Temp\VwCfgNew.exe
    "C:\Users\Admin\AppData\Local\Temp\VwCfgNew.exe" -vwuninstall
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\VwCfgNew.exe
    "C:\Users\Admin\AppData\Local\Temp\VwCfgNew.exe" -bakcfgdb
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A~NSISu_.exe

Path C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
Size 38KB
SHA256 e4443df1d3255cd1eb3fad89de5943341931f842498d327701dbefa7b00fa7c2
MD5 77d5904fb7d1c5a687b585b199f33828
SHA1 ae0ab177741d3900026b92ccf7abc211e9fd2e43
SHA512 579aa711970be9cd4116fb15cac3e9863d2fbfdccc35ca4711a28576ad3ab793daeea2b7d96e352ae6d98407a0354daf59c714f5faba341c6c4c3800e959ea33
SSDEEP 768:0w0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8JyJRngCY9aLyMW:0w0DsT0zikYCPMUxDRbw8JBx0o
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh32E8.tmp\LangDLL.dll
Size 5KB
SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
MD5 2c3c8976d729d28478a789217a882291
SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-17-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/1432-13-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/1432-12-0x0000000002260000-0x00000000022AC000-memory.dmp

Download

memory/1432-21-0x0000000002260000-0x00000000022AC000-memory.dmp

Download

memory/4440-19-0x0000000002390000-0x00000000023DC000-memory.dmp

Download

memory/4440-16-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/4440-15-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/4440-11-0x0000000002390000-0x00000000023DC000-memory.dmp

Download

memory/4440-23-0x0000000002B10000-0x0000000002B13000-memory.dmp

Download

memory/4440-24-0x0000000002B00000-0x0000000002B02000-memory.dmp

Download

memory/4440-22-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/4440-20-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/4440-18-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/4440-14-0x00000000023E0000-0x00000000023E1000-memory.dmp

Download

memory/4440-10-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/4440-27-0x0000000002B00000-0x0000000002B02000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads