51b4b2b477d5a03789241c1f93304796c0a12ab93fa48ff08b6b1a42c462096c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe
Size

67KB
MD5

0a24574cd9f484a9a72056fb187758d8
SHA1

65502d1fdac883d33eff6f335eab9ef87ac8e9eb
SHA256

7947b56a572bb9de99145af441ceb0f58000ca1048e6e3cdf7db397add40794d
SHA512

12a4243d5f6672d80d22e767fa3b8b1aa73ab1afef4ce4ec0524e4555ca49f04c593df6240b7e7ef7ef526ca7ab38c62e43fc1c30bb02e82d6b9b1b26eacea56
SSDEEP

1536:AU+dcy3fxBk9UmZHs/hcQgdLeAyNxdnw+HMKUKB5TiN5h:ANzPHk9MpcQceAcwWMKU6k

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2948	Un_A.exe

Loads dropped DLL 3 IoCs

pid	Process
2004	uninst.exe
2948	Un_A.exe
2948	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral9/files/0x00060000000158d9-2.dat	nsis_installer_1
behavioral9/files/0x00060000000158d9-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	Un_A.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28
PID 2004 wrote to memory of 2948	2004	uninst.exe	28

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso908.tmp\System.dll

Filesize
11KB

MD5
55a26d7800446f1373056064c64c3ce8

SHA1
80256857e9a0a9c8897923b717f3435295a76002

SHA256
904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

SHA512
04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

Download Submit
\Users\Admin\AppData\Local\Temp\nso908.tmp\nsDialogs.dll

Filesize
9KB

MD5
ee449b0adce56fbfa433b0239f3f81be

SHA1
ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

SHA256
c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

SHA512
22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
67KB

MD5
0a24574cd9f484a9a72056fb187758d8

SHA1
65502d1fdac883d33eff6f335eab9ef87ac8e9eb

SHA256
7947b56a572bb9de99145af441ceb0f58000ca1048e6e3cdf7db397add40794d

SHA512
12a4243d5f6672d80d22e767fa3b8b1aa73ab1afef4ce4ec0524e4555ca49f04c593df6240b7e7ef7ef526ca7ab38c62e43fc1c30bb02e82d6b9b1b26eacea56

Download Submit