Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 07:40

General

  • Target

    Uninstall.exe

  • Size

    75KB

  • MD5

    f64e77bc3093b25e62148d784d55267a

  • SHA1

    635fc5f0d655bbecbdc06ba3ecece1f0574ec311

  • SHA256

    298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584

  • SHA512

    086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce

  • SSDEEP

    1536:sjoUxZbE+HOI66qkryz9zIXg/EW58gL0AzCa/YR2nbn+m37:sdxNE+Hb+eyz9zIXeEW530ADAqb/L

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\InstallOptions.dll
    Filesize

    15KB

    MD5

    f8d9d9418e6e1827ed2b53dd930e48fb

    SHA1

    c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8

    SHA256

    2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4

    SHA512

    510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc

  • C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\ioSpecial.ini
    Filesize

    1KB

    MD5

    5f7f7392de5ff68a205fc781fb357750

    SHA1

    48a54ae335ff89330aa81e9f813676a92d64c342

    SHA256

    847f3764ebd2390ba095a2837bdcf822ac0a92ba07ae8e08c6b02cc8c1044bc2

    SHA512

    4fd334111fef047e673df5c6691788be3acf204f8b5e8b2ff654c295f4ccd4b9bbd45f17f69b3f229af57f9b616683c688644e7ec93a7284f5facdebc762df7e

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    Filesize

    75KB

    MD5

    f64e77bc3093b25e62148d784d55267a

    SHA1

    635fc5f0d655bbecbdc06ba3ecece1f0574ec311

    SHA256

    298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584

    SHA512

    086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce