Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    01-05-2024 03:14

General

  • Target

    uninst.exe

  • Size

    74KB

  • MD5

    824c6a64db468ffa51a3adcc94eb4357

  • SHA1

    55ff974e05d677b92d9ffe09a87fe2fcffdc2cfb

  • SHA256

    7a19501139f17d9fc5cfd90719e391775b5596a258cd3167838473b692f913ee

  • SHA512

    b46dcb2800cf2853a621e73c4d982510b9252747544bffc5ef4c2c304c2219937a7fc7be4716801b5ddbe3e35f307160cc5b614af888771baa3a3113ea3d13f6

  • SSDEEP

    1536:FFI4LGXy7W7EJGb90DcYzIagmYRN5L9A5AuG+TFgeK7Bj:/IWGC7W7BuDcYzIaxqZ9AVTF7MBj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninst.exe
    "C:\Users\Admin\AppData\Local\Temp\uninst.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:904

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    Filesize

    74KB

    MD5

    824c6a64db468ffa51a3adcc94eb4357

    SHA1

    55ff974e05d677b92d9ffe09a87fe2fcffdc2cfb

    SHA256

    7a19501139f17d9fc5cfd90719e391775b5596a258cd3167838473b692f913ee

    SHA512

    b46dcb2800cf2853a621e73c4d982510b9252747544bffc5ef4c2c304c2219937a7fc7be4716801b5ddbe3e35f307160cc5b614af888771baa3a3113ea3d13f6