7a43029a35098206491bced900ea487e0e533c7fe6a09fdd07488a9bc6ecfc64

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninstall.exe
Size 669KB
Sample240404-3hda5aec62
SHA256 43044fb087405d0a3988e75bc101ff74ca281066a59897ee0cf75eef1fc36f26
MD5 3969033219e0f4e6b7f85a23c5ab6419
SHA1 4fd5e8443b8e957c423ccd71b1fde72760a49789
SHA512 55ce5adaa7cf9b9f3f7715361037c5e8fe67008efd0b493f95cc49180e5dab2945b8f45f66ae4d5b2f933303eb55d14ff7aeef5d9c16a17abaa71b1ec4aab719
SSDEEP 12288:QY3mDkf6/TN/4mNb5xeiWWlqdWs5EqgTcTzn4nqP/sEWiOLYFh8c4uHJx:QY3mU2TuAuBWsOTcTbTAs2RuHj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2920	Un_A.exe

Loads dropped DLL 3 IoCs

pid	Process
2916	uninstall.exe
2920	Un_A.exe
2920	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2920	2916	uninstall.exe	28
PID 2916 wrote to memory of 2920	2916	uninstall.exe	28
PID 2916 wrote to memory of 2920	2916	uninstall.exe	28
PID 2916 wrote to memory of 2920	2916	uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path \Users\Admin\AppData\Local\Temp\nsdFE6D.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsdFE6D.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Un_A.exe

Path \Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 669KB
SHA256 43044fb087405d0a3988e75bc101ff74ca281066a59897ee0cf75eef1fc36f26
MD5 3969033219e0f4e6b7f85a23c5ab6419
SHA1 4fd5e8443b8e957c423ccd71b1fde72760a49789
SHA512 55ce5adaa7cf9b9f3f7715361037c5e8fe67008efd0b493f95cc49180e5dab2945b8f45f66ae4d5b2f933303eb55d14ff7aeef5d9c16a17abaa71b1ec4aab719
SSDEEP 12288:QY3mDkf6/TN/4mNb5xeiWWlqdWs5EqgTcTzn4nqP/sEWiOLYFh8c4uHJx:QY3mU2TuAuBWsOTcTbTAs2RuHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads