7eb8647ef59682e127eb5b698cb2d496a6c87790c88a69ab5bdf7f682ee7d171

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 12:17

Target

uninstall.exe
Size

259KB
MD5

22a26bb892e35810581882bcfc52c652
SHA1

eb734ca419687009c75229213ae285649a3c5921
SHA256

7723d04405e97cefd0e220133fbdb07acfb3bcb11e2607dc71482d555744ac8b
SHA512

61d0c5f55a13041e201818ba7cfa6319cbfed42f4d186b8b729e71ebf4388e59a7eda67ecf09e6c4de1a12d1cab30b21ce8f7b76d807cb1988eb455ea8c04082
SSDEEP

6144:rJ9ECqBWtxiRuQOWF0HWR5WA1MsaAPXO4CnssN0Ffb69d3J6kY62nOf:rvsRfF7vzfb69j6kY62C

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

1872 Un_A.exe
Loads dropped DLL 3 IoCs

Processes:

uninstall.exeUn_A.exe

pid process

2012 uninstall.exe
1872 Un_A.exe
1872 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Un_A.exe

pid process

1872 Un_A.exe

pid	process
1872	Un_A.exe

pid	process
1872	Un_A.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe
PID 2012 wrote to memory of 1872	2012	uninstall.exe	Un_A.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsoED2.tmp\LangDLL.dll

Filesize
8KB

MD5
e5240dcd169abe69a7332d01106e1d84

SHA1
2ca68892501102586f6ab4eb99744d7f6138c166

SHA256
96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

SHA512
519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

Download Submit
\Users\Admin\AppData\Local\Temp\nsoED2.tmp\nsDialogs.dll

Filesize
14KB

MD5
8f45e78d9d02ca8a9f9c274a8bfe2a57

SHA1
9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

SHA256
78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

SHA512
125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
259KB

MD5
22a26bb892e35810581882bcfc52c652

SHA1
eb734ca419687009c75229213ae285649a3c5921

SHA256
7723d04405e97cefd0e220133fbdb07acfb3bcb11e2607dc71482d555744ac8b

SHA512
61d0c5f55a13041e201818ba7cfa6319cbfed42f4d186b8b729e71ebf4388e59a7eda67ecf09e6c4de1a12d1cab30b21ce8f7b76d807cb1988eb455ea8c04082

Download Submit
memory/1872-24-0x0000000074FA0000-0x0000000074FAC000-memory.dmp

Filesize
48KB

Download
memory/1872-23-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2012-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download