Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 02:13

General

  • Target

    uninst.exe

  • Size

    290KB

  • MD5

    78366c7f86a685e23eb897c6f34eb503

  • SHA1

    1c01a172a7137890b6b5a4b4fac0f9d8562b5ac0

  • SHA256

    51f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b

  • SHA512

    20967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a

  • SSDEEP

    6144:ke34KGjndtYt7Z+n9pGnVoUc99jCbd2/whMcitrqjGIu:fGjn4sGnGxnmiJ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninst.exe
    "C:\Users\Admin\AppData\Local\Temp\uninst.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe
        "C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe" /uninstallsucc
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        PID:2616

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\config.ini

          Filesize

          402B

          MD5

          74ed4c94c0bf9e64ddd3d81e90bc8e44

          SHA1

          f0a5721e6e7b64408a7aba1a51f0c4c281dced33

          SHA256

          20e4f8b6a34dd809495e912b22f8527b27758b489459ade68bf2fdd4c3bb4d53

          SHA512

          e9181b9fa0761750f245ff7ddd9b8a1f912e0042b3e0ad58a694a9ad59f5e3ed7f29fd8b29f434285a7d2a4d675cf583c6fffbc362a478a065a67c4237c09cf9

        • C:\Users\Admin\AppData\Local\Temp\nst5BFC.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • C:\Users\Admin\AppData\Local\Temp\nst5BFC.tmp\inetc.dll

          Filesize

          20KB

          MD5

          c498ae64b4971132bba676873978de1e

          SHA1

          92e4009cd776b6c8616d8bffade7668ef3cb3c27

          SHA256

          5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

          SHA512

          8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          290KB

          MD5

          78366c7f86a685e23eb897c6f34eb503

          SHA1

          1c01a172a7137890b6b5a4b4fac0f9d8562b5ac0

          SHA256

          51f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b

          SHA512

          20967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a

        • memory/3984-10-0x0000000010000000-0x0000000010003000-memory.dmp

          Filesize

          12KB