1eb4db65ad70c914b2f5690d3ea5a3710578a60209780d228389ca0c305b0057

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help/uninstall.exe
Size

46KB
MD5

2b0824752cc7ef5245a3aaa34d381843
SHA1

e148e64359f28d255d4f2312480cd3daf0c1c12f
SHA256

fb0d01d7c91cb65deaf5bb37831c5dece87402d8895f892d166afb2e722a55d5
SHA512

29676e391c0d67426a277a5b0cdb1436f4c148c57dbd351a4214d56d478eda91b3aec70efe32baac3d07a1dae040ba3925e3f58a14e1510ac9a0a5cf4d806459
SSDEEP

768:2IUZK41V3AhyRc7t9pK1B96uUdS3iN8frFS6sWkJAqPxLerazCcXDxP2EXxUj88:nAbk8OFzTqbkJJPxKrazCadXXC7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1092	Au_.exe

Loads dropped DLL 5 IoCs

pid	Process
2184	uninstall.exe
1092	Au_.exe
1092	Au_.exe
1092	Au_.exe
1092	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral13/files/0x000d0000000122a3-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28
PID 2184 wrote to memory of 1092	2184	uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Help\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Help\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\Help\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy30E1.tmp\ioSpecial.ini

Filesize
583B

MD5
0d134caeadf21d6365b8693b8488c1fa

SHA1
3c49d3ec1b4be7f6838032b87b532c1f8d32c53c

SHA256
f1121cc3cb63d45af20596c0b9ea17095ca87b5281deb02fb5cc46e8b11c58f3

SHA512
162b883a4d2f41c7a9fabec0db9c9f59dc270dd685456c5cc0bff4a432a8fea46c10a674038b25443367f750ed72aefb07640ebc29a8b978b0ad6ea4e5ef0672

Download Submit
\Users\Admin\AppData\Local\Temp\nsy30E1.tmp\InstallOptions.dll

Filesize
12KB

MD5
444e1109d960c307df0ca2b33a24731b

SHA1
55e3b57d06128911ed4af44858d199d9b1945edc

SHA256
b3ba181120cd5b57e2cd5435bbd64c3257f7525ade359f89554e93f466692125

SHA512
9efdb45ee0eae73c24d3f01ff799160090f2b1f0f28ee8da3af52992fec220bf905070ce5a6cc1b5657642440ad29c22bc6889cd3ee1f674a908a935dcf4c2a8

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
46KB

MD5
2b0824752cc7ef5245a3aaa34d381843

SHA1
e148e64359f28d255d4f2312480cd3daf0c1c12f

SHA256
fb0d01d7c91cb65deaf5bb37831c5dece87402d8895f892d166afb2e722a55d5

SHA512
29676e391c0d67426a277a5b0cdb1436f4c148c57dbd351a4214d56d478eda91b3aec70efe32baac3d07a1dae040ba3925e3f58a14e1510ac9a0a5cf4d806459

Download Submit