87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9

Analysis

max time kernel
122s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 01:18

Target

GeodeUninstaller.exe
Size

84KB
MD5

b7d4ad3ce687a4a8524a6b17b71ee065
SHA1

92cfe1d4a16f15d87dd69244326a77c1422fe76f
SHA256

619219cf5bd0f7413bf31b34b4f578ad610cc2be8289dccb3555dea06642b28c
SHA512

02fa2043793eefe200667a55d1fa6655a1a4d99efb723c19edd4e54f5f47c7c910440b0a57a57d65d8daeebab65490d6d6a3cdc36e20179230af8b91d800267c
SSDEEP

1536:UferrLkSRoe8C4UZsys0Dh1duX6ekrm2y5rTX7IS0hyv4uL7010n6BBF5:Ufi3k+oWDBDh1dun+y5r8hGN70+n6Xf

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un.exe

pid process

1992 Un.exe
Loads dropped DLL 1 IoCs

Processes:

Un.exe

pid process

1992 Un.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1992	Un.exe

pid	process
1992	Un.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

GeodeUninstaller.exe

description	pid	process	target process
PID 3548 wrote to memory of 1992	3548	GeodeUninstaller.exe	Un.exe
PID 3548 wrote to memory of 1992	3548	GeodeUninstaller.exe	Un.exe
PID 3548 wrote to memory of 1992	3548	GeodeUninstaller.exe	Un.exe

C:\Users\Admin\AppData\Local\Temp\GeodeUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\GeodeUninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5020

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsq2D17.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe

Filesize
84KB

MD5
b7d4ad3ce687a4a8524a6b17b71ee065

SHA1
92cfe1d4a16f15d87dd69244326a77c1422fe76f

SHA256
619219cf5bd0f7413bf31b34b4f578ad610cc2be8289dccb3555dea06642b28c

SHA512
02fa2043793eefe200667a55d1fa6655a1a4d99efb723c19edd4e54f5f47c7c910440b0a57a57d65d8daeebab65490d6d6a3cdc36e20179230af8b91d800267c

Download Submit