Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 07:40

General

  • Target

    Uninstall.exe

  • Size

    75KB

  • MD5

    f64e77bc3093b25e62148d784d55267a

  • SHA1

    635fc5f0d655bbecbdc06ba3ecece1f0574ec311

  • SHA256

    298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584

  • SHA512

    086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce

  • SSDEEP

    1536:sjoUxZbE+HOI66qkryz9zIXg/EW58gL0AzCa/YR2nbn+m37:sdxNE+Hb+eyz9zIXeEW530ADAqb/L

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1672

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd234B.tmp\ioSpecial.ini
    Filesize

    1KB

    MD5

    baa6f73a0a2dcbdf6456c3af197fadee

    SHA1

    fe56e244aaff451035f415b9dfd8b48879565ead

    SHA256

    4648783c11860351a82de8afc4b0756669b42ceddaad47fc212192f2981013c4

    SHA512

    75926fddd5ce3cde8bf3e75782fde8c7730b72299c63b2134fe598618ec675b5ab6c77f4ccfb968260451d4828c9952ccdcb4e2cc071fc0b1d685ed555175c0d

  • C:\Users\Admin\AppData\Local\Temp\nsd234B.tmp\ioSpecial.ini
    Filesize

    1KB

    MD5

    32e67a6924e6f9ddb51e1fc28218c7fc

    SHA1

    aba16991b11e85844cc1751e45b74eb7d17ea19d

    SHA256

    24a436446e1e389c2a3963adf210a0eed6898cbaf139497c97361dfe4f4d9657

    SHA512

    1621678b400c98792fffc94bd4eb52715e48b135917da52757351f1baf6733e61bc313c551dab704cbec92a55be0c49aa549862cf85d39541fa7a26ef07c9846

  • \Users\Admin\AppData\Local\Temp\nsd234B.tmp\InstallOptions.dll
    Filesize

    15KB

    MD5

    f8d9d9418e6e1827ed2b53dd930e48fb

    SHA1

    c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8

    SHA256

    2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4

    SHA512

    510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    Filesize

    75KB

    MD5

    f64e77bc3093b25e62148d784d55267a

    SHA1

    635fc5f0d655bbecbdc06ba3ecece1f0574ec311

    SHA256

    298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584

    SHA512

    086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce