e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 06:13

Target

uninstall.exe
Size

57KB
MD5

3dd164e1390999df68f79ddb0fb77818
SHA1

bd0fb9fff84ca0c89726d6669c32b46482911705
SHA256

c7358c274c33377a6aaeab76b13e5eec4f9af598875a59c07951b5ec0bf09e86
SHA512

3ffdcfa36bc7f4ef6b028be2942340e3c25e3cf9d5d82953479cc27303ad7ea522a950a10210afe0776a8f12cc459c49fa30607c914b137a38a216dbd50bd28b
SSDEEP

1536:UU+dcy3fxBk9UmZHs/hcnBgdLeAyNxHQDqAzk:UNzPHk9MpcBceA5DNzk

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

4588 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4588	Un_A.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 1312 wrote to memory of 4588	1312	uninstall.exe	Un_A.exe
PID 1312 wrote to memory of 4588	1312	uninstall.exe	Un_A.exe
PID 1312 wrote to memory of 4588	1312	uninstall.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
PID:4588

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Filesize
57KB

MD5
3dd164e1390999df68f79ddb0fb77818

SHA1
bd0fb9fff84ca0c89726d6669c32b46482911705

SHA256
c7358c274c33377a6aaeab76b13e5eec4f9af598875a59c07951b5ec0bf09e86

SHA512
3ffdcfa36bc7f4ef6b028be2942340e3c25e3cf9d5d82953479cc27303ad7ea522a950a10210afe0776a8f12cc459c49fa30607c914b137a38a216dbd50bd28b

Download Submit