4191ad6b7c669b7566bc56bb517b9a080c2a1b7c6b04c3a9bc48a845c440a433

Analysis

max time kernel
74s
max time network
85s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-04-2024 04:42

Target

uninst.exe
Size

57KB
MD5

95e8be2b960f1aeaa7f74b704d7fecdd
SHA1

60a20cd1bf83eb60e1c06ef78fd705bd286cd6a9
SHA256

170b6874487f033efc569ddddd1134888df9083d62b6c504b8a011c5b5d845c1
SHA512

21c0a0466f7cfc7e7eae1f7d1fc606a2363da77626a7dbf64746d3698d90559e64416678f2b72e976a9a69ac7f760140da656c5ae064b0a3b2fa12836a6a00c7
SSDEEP

1536:kHYMiClDhdyA5x5Z0DvyecSgc+LeAyN/JT8WFB:QYjClDhQlDvrcSkeAsTjX

Score

7^/10

Deletes itself 1 IoCs

Processes:

Un_A.exe

pid process

4916 Un_A.exe
Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

4916 Un_A.exe
Loads dropped DLL 1 IoCs

Processes:

Un_A.exe

pid process

4916 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4916	Un_A.exe

pid	process
4916	Un_A.exe

pid	process
4916	Un_A.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

uninst.exe

description	pid	process	target process
PID 1672 wrote to memory of 4916	1672	uninst.exe	Un_A.exe
PID 1672 wrote to memory of 4916	1672	uninst.exe	Un_A.exe
PID 1672 wrote to memory of 4916	1672	uninst.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Filesize
57KB

MD5
95e8be2b960f1aeaa7f74b704d7fecdd

SHA1
60a20cd1bf83eb60e1c06ef78fd705bd286cd6a9

SHA256
170b6874487f033efc569ddddd1134888df9083d62b6c504b8a011c5b5d845c1

SHA512
21c0a0466f7cfc7e7eae1f7d1fc606a2363da77626a7dbf64746d3698d90559e64416678f2b72e976a9a69ac7f760140da656c5ae064b0a3b2fa12836a6a00c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA818.tmp\UserInfo.dll
Filesize
4KB

MD5
dada3e1836af78d5b24499da252d01e4

SHA1
d2a1c25405e3c74973cf18dec2c7138df9e96a83

SHA256
0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7

SHA512
f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66

Download Submit