1eb4db65ad70c914b2f5690d3ea5a3710578a60209780d228389ca0c305b0057

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help/uninstall.exe
Size

46KB
MD5

2b0824752cc7ef5245a3aaa34d381843
SHA1

e148e64359f28d255d4f2312480cd3daf0c1c12f
SHA256

fb0d01d7c91cb65deaf5bb37831c5dece87402d8895f892d166afb2e722a55d5
SHA512

29676e391c0d67426a277a5b0cdb1436f4c148c57dbd351a4214d56d478eda91b3aec70efe32baac3d07a1dae040ba3925e3f58a14e1510ac9a0a5cf4d806459
SSDEEP

768:2IUZK41V3AhyRc7t9pK1B96uUdS3iN8frFS6sWkJAqPxLerazCcXDxP2EXxUj88:nAbk8OFzTqbkJJPxKrazCadXXC7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3372	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
3372	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral14/files/0x000800000002322a-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3372	992	uninstall.exe	87
PID 992 wrote to memory of 3372	992	uninstall.exe	87
PID 992 wrote to memory of 3372	992	uninstall.exe	87

C:\Users\Admin\AppData\Local\Temp\Help\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Help\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\Help\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa6DFD.tmp\InstallOptions.dll

Filesize
12KB

MD5
444e1109d960c307df0ca2b33a24731b

SHA1
55e3b57d06128911ed4af44858d199d9b1945edc

SHA256
b3ba181120cd5b57e2cd5435bbd64c3257f7525ade359f89554e93f466692125

SHA512
9efdb45ee0eae73c24d3f01ff799160090f2b1f0f28ee8da3af52992fec220bf905070ce5a6cc1b5657642440ad29c22bc6889cd3ee1f674a908a935dcf4c2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6DFD.tmp\ioSpecial.ini

Filesize
623B

MD5
9d8c5262caf6983973df17ae91372527

SHA1
6da663048e50121b36850c97b34325db77b21a83

SHA256
b2710677aebeff9dadf007d9f40d6fa35d760f273bea5bd38a0317a2d221c35c

SHA512
8c5d1fbeaec8a79a1c5ee0eae66e053bb1cbea727d329d14f8f015eefc0c8db7bb430d926454f4618897820b8141de27d2f8f3d0059d63c63d8aac00a20447d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
46KB

MD5
2b0824752cc7ef5245a3aaa34d381843

SHA1
e148e64359f28d255d4f2312480cd3daf0c1c12f

SHA256
fb0d01d7c91cb65deaf5bb37831c5dece87402d8895f892d166afb2e722a55d5

SHA512
29676e391c0d67426a277a5b0cdb1436f4c148c57dbd351a4214d56d478eda91b3aec70efe32baac3d07a1dae040ba3925e3f58a14e1510ac9a0a5cf4d806459

Download Submit