Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 19:13

General

  • Target

    Uninstall.exe

  • Size

    49KB

  • MD5

    47d3a1dee4f8a3ea72850c24d853a59d

  • SHA1

    36ef3fdae7709fae34715e76c10bbcb60d021a38

  • SHA256

    94f69d567ecf9e117eb744a965bff820cee36202156049c8f5da6d5c87463dd9

  • SHA512

    c3429ab3a4f515dd5672832133b63b6f3e278ce846c5d929519d8856b124d99955d175a51afac486ac0010b01bc420e80f347deabd3a25b35e1fb336434a7bb7

  • SSDEEP

    1536:DRf1o2Ca7qiagSshdS0D6mJjgdLeAyNLhte:Dpj7EUbD6mJjceAQg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    49KB

    MD5

    47d3a1dee4f8a3ea72850c24d853a59d

    SHA1

    36ef3fdae7709fae34715e76c10bbcb60d021a38

    SHA256

    94f69d567ecf9e117eb744a965bff820cee36202156049c8f5da6d5c87463dd9

    SHA512

    c3429ab3a4f515dd5672832133b63b6f3e278ce846c5d929519d8856b124d99955d175a51afac486ac0010b01bc420e80f347deabd3a25b35e1fb336434a7bb7