1c158db04b4efc7e8440d25c4a4e16658bc43a0f084c3c16d9fa80f5fb9cfc95

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 06:03

Target

uninstall.exe
Size

61KB
MD5

395b51218583e47a7358e044acc3448b
SHA1

c47fbb0aec595d8551c777f3016a142630ac6780
SHA256

fcdadb8a0173828def8f1eddbe6fadbcecdd9296dc0c7b45ba7135b2db04d621
SHA512

4418e37cde0fb403307344b53d84b2a167473311dcad3981b4ed3aeec2c31d441a9dbc2640a103d4be17b3facc8881a33e82b33bd508f281a2accb200934dfab
SSDEEP

1536:ejoUxZbE+HOI66qkryz9zIMg/EW58gL0AzCVhf3:edxNE+Hb+eyz9zIMeEW530AYv

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2332 Au_.exe
Loads dropped DLL 1 IoCs

Processes:

uninstall.exe

pid process

2036 uninstall.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Au_.exe

pid process

2332 Au_.exe

pid	process
2332	Au_.exe

pid	process
2036	uninstall.exe

pid	process
2332	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 2036 wrote to memory of 2332	2036	uninstall.exe	Au_.exe
PID 2036 wrote to memory of 2332	2036	uninstall.exe	Au_.exe
PID 2036 wrote to memory of 2332	2036	uninstall.exe	Au_.exe
PID 2036 wrote to memory of 2332	2036	uninstall.exe	Au_.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
61KB

MD5
395b51218583e47a7358e044acc3448b

SHA1
c47fbb0aec595d8551c777f3016a142630ac6780

SHA256
fcdadb8a0173828def8f1eddbe6fadbcecdd9296dc0c7b45ba7135b2db04d621

SHA512
4418e37cde0fb403307344b53d84b2a167473311dcad3981b4ed3aeec2c31d441a9dbc2640a103d4be17b3facc8881a33e82b33bd508f281a2accb200934dfab

Download Submit