4fb3b4a9b098c5c60d7887df0598a6f98c61e90d4a9b2dec1220cbbfd9f2ccc0

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

51KB
MD5

e7bb10f884e4b519da8da434a954bfdc
SHA1

a590e41e862572cc5bc9cc02b088343dbd81ce29
SHA256

d259a87d13e9beafd73b8aa19a4baa792cecb9227f1d4e0ff6e9728be8ff124c
SHA512

865568819aea2f270b7f186054e317533d7d53027c68b6ce62faaf6b359ad0b56f415188b6b7d022bf4f8cdbb2a8973f7642e1e0c673fb5fd5c8ab56f46e3979
SSDEEP

1536:wLXB65939tY6HBg4sXJJl3Gl1VhzDRE9U+idVf:wLk395hYXJ7YTve9WDf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
1264	Uninstall.exe
2392	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral17/files/0x000b00000001565d-2.dat	nsis_installer_1
behavioral17/files/0x000b00000001565d-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2392	1264	Uninstall.exe	28
PID 1264 wrote to memory of 2392	1264	Uninstall.exe	28
PID 1264 wrote to memory of 2392	1264	Uninstall.exe	28
PID 1264 wrote to memory of 2392	1264	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst168E.tmp\UAC.dll

Filesize
13KB

MD5
431e5b960aa15af5d153bae6ba6b7e87

SHA1
e090c90be02e0bafe5f3d884c0525d8f87b3db40

SHA256
a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13

SHA512
f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
51KB

MD5
e7bb10f884e4b519da8da434a954bfdc

SHA1
a590e41e862572cc5bc9cc02b088343dbd81ce29

SHA256
d259a87d13e9beafd73b8aa19a4baa792cecb9227f1d4e0ff6e9728be8ff124c

SHA512
865568819aea2f270b7f186054e317533d7d53027c68b6ce62faaf6b359ad0b56f415188b6b7d022bf4f8cdbb2a8973f7642e1e0c673fb5fd5c8ab56f46e3979

Download Submit