Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 18:02

General

  • Target

    Uninstall.exe

  • Size

    98KB

  • MD5

    c7980b746b65bb560eedc436c61cc631

  • SHA1

    c22b3053db2bd827655ee7a96610dbba7474f57e

  • SHA256

    641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3

  • SHA512

    169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481

  • SSDEEP

    1536:AAuU2UTyxtFdkJ3sBCGMKHL3zkTtYYiU4BSSxyFYcWHAt5SckPhSGetbk:Ak5+bFdkJ7HKHLD+6BSSxyFYHOSc6ae

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
      "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso8078.tmp\ioSpecial.ini

    Filesize

    604B

    MD5

    18f674fd90df51b434d7462f36df4c7a

    SHA1

    a34a69a5804048315f64130f0cf6b719459b9aa3

    SHA256

    527327771aeccda05fbf1890f7f4c77627323cdb2ce33ea62fd4fe5edced4f4d

    SHA512

    b857c3819ff4e4153da18d9f3afab71d91359918d05c787522eeb2c64f0c3d79c4efc4556a1ed2b551b9fdcaeef25b7ed3cf7f5cf12302b88fb596efae0dcb0b

  • \Users\Admin\AppData\Local\Temp\A~NSISu_.exe

    Filesize

    98KB

    MD5

    c7980b746b65bb560eedc436c61cc631

    SHA1

    c22b3053db2bd827655ee7a96610dbba7474f57e

    SHA256

    641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3

    SHA512

    169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481

  • \Users\Admin\AppData\Local\Temp\nso8078.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    57db62366ef11fdc47922a02031f0492

    SHA1

    6d30db5285b653025f94e74b9b045870dc0aeb7a

    SHA256

    2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

    SHA512

    d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

  • \Users\Admin\AppData\Local\Temp\nso8078.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    593345196fcd1c553b0702cc026ccccd

    SHA1

    84446849c10e0c4d6683072f4c2eea5a085bac2f

    SHA256

    fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d

    SHA512

    b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306