7eb8647ef59682e127eb5b698cb2d496a6c87790c88a69ab5bdf7f682ee7d171

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

259KB
MD5

22a26bb892e35810581882bcfc52c652
SHA1

eb734ca419687009c75229213ae285649a3c5921
SHA256

7723d04405e97cefd0e220133fbdb07acfb3bcb11e2607dc71482d555744ac8b
SHA512

61d0c5f55a13041e201818ba7cfa6319cbfed42f4d186b8b729e71ebf4388e59a7eda67ecf09e6c4de1a12d1cab30b21ce8f7b76d807cb1988eb455ea8c04082
SSDEEP

6144:rJ9ECqBWtxiRuQOWF0HWR5WA1MsaAPXO4CnssN0Ffb69d3J6kY62nOf:rvsRfF7vzfb69j6kY62C

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1872	Un_A.exe

Loads dropped DLL 3 IoCs

pid	Process
2012	uninstall.exe
1872	Un_A.exe
1872	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	Un_A.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28
PID 2012 wrote to memory of 1872	2012	uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoED2.tmp\LangDLL.dll

Filesize
8KB

MD5
e5240dcd169abe69a7332d01106e1d84

SHA1
2ca68892501102586f6ab4eb99744d7f6138c166

SHA256
96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

SHA512
519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

Download Submit
\Users\Admin\AppData\Local\Temp\nsoED2.tmp\nsDialogs.dll

Filesize
14KB

MD5
8f45e78d9d02ca8a9f9c274a8bfe2a57

SHA1
9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

SHA256
78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

SHA512
125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
259KB

MD5
22a26bb892e35810581882bcfc52c652

SHA1
eb734ca419687009c75229213ae285649a3c5921

SHA256
7723d04405e97cefd0e220133fbdb07acfb3bcb11e2607dc71482d555744ac8b

SHA512
61d0c5f55a13041e201818ba7cfa6319cbfed42f4d186b8b729e71ebf4388e59a7eda67ecf09e6c4de1a12d1cab30b21ce8f7b76d807cb1988eb455ea8c04082

Download Submit
memory/1872-24-0x0000000074FA0000-0x0000000074FAC000-memory.dmp

Filesize
48KB

Download
memory/1872-23-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2012-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download