Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 16:51

General

  • Target

    $R1/$_1_/Uninstall.exe

  • Size

    505KB

  • MD5

    ee2cf86633ae043d006c9c8fded2a999

  • SHA1

    c18889ee32620e40a366f8cbd5e62e26f5dc2b37

  • SHA256

    02b631c95364397d1ec91c65007f00b9d7baafef05ddb51b7b9fe9ba35234f53

  • SHA512

    57695a4e408dd07f8d0c8c3befd7d2a2710dc1f50fefe61a4961729bca2d611925e63390d1375d3e5270930ee944b6d4e2858891b05d4d9d8c96c260b7e4bb4f

  • SSDEEP

    6144:r50gUCimyti5ELY4jurNXa4bbOV1p7VulOCkqt:d0gOmwO4SrNXhOV1p7klO8t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\Uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4704

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\System.dll
    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\UAC.dll
    Filesize

    13KB

    MD5

    a88baad3461d2e9928a15753b1d93fd7

    SHA1

    bb826e35264968bbc3b981d8430ac55df1e6d4a6

    SHA256

    c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af

    SHA512

    5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a

  • C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\apphelp.dll
    Filesize

    1.8MB

    MD5

    bc8f81f42505bf9def590d7fe89da46c

    SHA1

    5f648334bd6d09c7388be43deb7461d4a47e36fe

    SHA256

    a74e88300bc96ff413dd0b289a5023649592a7f2e68793d0a5ff71c6dc5f4130

    SHA512

    91b08f39675f9456f05c9b2939eba3c778b0ce7f9558ecba6aea36832d526d01a9da4196e56023cf45b3d147834db7bcd9aef2997a103a497c9c527d13126b6c

  • C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    4ccc4a742d4423f2f0ed744fd9c81f63

    SHA1

    704f00a1acc327fd879cf75fc90d0b8f927c36bc

    SHA256

    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

    SHA512

    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

  • C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\registry.dll
    Filesize

    24KB

    MD5

    2b7007ed0262ca02ef69d8990815cbeb

    SHA1

    2eabe4f755213666dbbbde024a5235ddde02b47f

    SHA256

    0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    SHA512

    aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    Filesize

    505KB

    MD5

    ee2cf86633ae043d006c9c8fded2a999

    SHA1

    c18889ee32620e40a366f8cbd5e62e26f5dc2b37

    SHA256

    02b631c95364397d1ec91c65007f00b9d7baafef05ddb51b7b9fe9ba35234f53

    SHA512

    57695a4e408dd07f8d0c8c3befd7d2a2710dc1f50fefe61a4961729bca2d611925e63390d1375d3e5270930ee944b6d4e2858891b05d4d9d8c96c260b7e4bb4f

  • memory/4704-15-0x00000000030F0000-0x0000000003149000-memory.dmp
    Filesize

    356KB