c8e6a5f1bb47344fbe4cf2145cb97e6b4c995d99e074b924fe66cc8d8a209c9b

Analysis

max time kernel
485s
max time network
585s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 17:33

Target

uninstall.exe
Size

624KB
MD5

dd6df88d0ad192f77b20d345c636c699
SHA1

b1bcaad02c099710f75b28f1a985361b6e5c0b2e
SHA256

b970dae1b0a8bdee357b37c87f8320fa271405143b686d4258950d151379a529
SHA512

6543ff07adb0b51532351fea227ad0765e12c6cfd4cdb05c1d59bc4203ef91c5b10d642763af9fce6243cc6e983d4548b4f5bb43783f8187e0153317677a9f2b
SSDEEP

12288:AYDJg+RwCySGzEL7vqkQo2me4Xig6wnDMShbnLAV4xXEjiDTaIlRRZKYuwtk:AYDy5lzEL7vZDV6wnoMkwXEjEaIlR7Kz

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

3628 Un_A.exe
Loads dropped DLL 2 IoCs

Processes:

Un_A.exe

pid process

3628 Un_A.exe
3628 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3628	Un_A.exe

pid	process
3628	Un_A.exe
3628	Un_A.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 4440 wrote to memory of 3628	4440	uninstall.exe	Un_A.exe
PID 4440 wrote to memory of 3628	4440	uninstall.exe	Un_A.exe
PID 4440 wrote to memory of 3628	4440	uninstall.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nse2B48.tmp\LangDLL.dll
Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse2B48.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Filesize
624KB

MD5
dd6df88d0ad192f77b20d345c636c699

SHA1
b1bcaad02c099710f75b28f1a985361b6e5c0b2e

SHA256
b970dae1b0a8bdee357b37c87f8320fa271405143b686d4258950d151379a529

SHA512
6543ff07adb0b51532351fea227ad0765e12c6cfd4cdb05c1d59bc4203ef91c5b10d642763af9fce6243cc6e983d4548b4f5bb43783f8187e0153317677a9f2b

Download Submit