965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninst Easy_Burning.exe
Size

47KB
MD5

60a7fa390d2b6061c309b0c8b4d95120
SHA1

e2094b3d416bc66ac78198ada11fffc36f8c74e7
SHA256

0832fda513aacf4f8c83c273572ba81b7f9b2f7146d5f53c6f6b5062b66bb8cf
SHA512

c8294865f28e978a6850a895594df476227c57471aff11bc14233d03c7d09c491ecbf2f3d7d17506c80768c5abe23bc29632362c70aac5c532a63d1a08fd4984
SSDEEP

768:pzXMDQjSd6UYmZa2qG4SRG9S9syxlI+zJRnfAm6kRRH2iZxUgejgN71J+gyWfojX:pL4Q2E+ZaSRG89tlDTAeLnUgggB1JDyr

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1340	Au_.exe

Loads dropped DLL 5 IoCs

pid	Process
2184	Uninst Easy_Burning.exe
1340	Au_.exe
1340	Au_.exe
1340	Au_.exe
1340	Au_.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral9/memory/2184-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral9/files/0x000d0000000122a3-4.dat	upx
behavioral9/memory/2184-6-0x0000000000480000-0x00000000004BB000-memory.dmp	upx
behavioral9/memory/2184-9-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral9/memory/1340-20-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1340	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28
PID 2184 wrote to memory of 1340	2184	Uninst Easy_Burning.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninst Easy_Burning.exe
"C:\Users\Admin\AppData\Local\Temp\Uninst Easy_Burning.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso33FD.tmp\LangDLL.dll

Filesize
5KB

MD5
4551aee5b604f7a4fdeb95dc1364adaa

SHA1
e6aa9b8072351b098a6b777616f4e949051dfc01

SHA256
e90123bb975b4d9a79efcf9e84f849d9de1c9a564f62197092e7f7ad718578d3

SHA512
0be8829d33af093b9bc6b5d6ee1506656b9fe513f518e1922804e93b59e3c5832f8ae78fa79fb095da5630765949af812cd7d88e2b42daed0150e5798abc9445

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
47KB

MD5
60a7fa390d2b6061c309b0c8b4d95120

SHA1
e2094b3d416bc66ac78198ada11fffc36f8c74e7

SHA256
0832fda513aacf4f8c83c273572ba81b7f9b2f7146d5f53c6f6b5062b66bb8cf

SHA512
c8294865f28e978a6850a895594df476227c57471aff11bc14233d03c7d09c491ecbf2f3d7d17506c80768c5abe23bc29632362c70aac5c532a63d1a08fd4984

Download Submit
memory/1340-20-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-1-0x0000000000240000-0x000000000027B000-memory.dmp

Filesize
236KB

Download
memory/2184-6-0x0000000000480000-0x00000000004BB000-memory.dmp

Filesize
236KB

Download
memory/2184-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-14-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download