7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb

Resubmissions

22-04-2024 22:02

22-04-2024 19:25

19-04-2024 03:02

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:02

Target

Uninstall.exe
Size

79KB
MD5

c35f0cb2adc35c19ef16e847d81cf2fd
SHA1

4b327c5296fcccc72b0e55e923cb2a9d4049beef
SHA256

9a2f76a40341a4ede271813c27e8da28da3108709b6c99f22abde151f60793e8
SHA512

44bc72732bc66ca23cc3ff0c30a57eb7fe2e3f2cf78f35eea5699cc571bde12e54da73aeebecd8ff4524f7e397dc86865034e03b25b3af366a88a3e091b0c6e8
SSDEEP

1536:JmsAYBdTU9fEAIS2PEtuLgjiLrGAv00ef3a:IfY/TU9fE9PEtuL+arGAK/a

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

3644 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3644	Un_A.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 4540 wrote to memory of 3644	4540	Uninstall.exe	Un_A.exe
PID 4540 wrote to memory of 3644	4540	Uninstall.exe	Un_A.exe
PID 4540 wrote to memory of 3644	4540	Uninstall.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:3644

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
79KB

MD5
c35f0cb2adc35c19ef16e847d81cf2fd

SHA1
4b327c5296fcccc72b0e55e923cb2a9d4049beef

SHA256
9a2f76a40341a4ede271813c27e8da28da3108709b6c99f22abde151f60793e8

SHA512
44bc72732bc66ca23cc3ff0c30a57eb7fe2e3f2cf78f35eea5699cc571bde12e54da73aeebecd8ff4524f7e397dc86865034e03b25b3af366a88a3e091b0c6e8

Download Submit