f81955d71f3b6bda792886a815e36fee54ab72b51e45c02533f3f7f1c9e9c7a0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:35

Target

uninst.exe
Size

64KB
MD5

96910c8a8d4b7ede90a59c90d105c511
SHA1

413e570bcb74495a7d4dd8b96ab64aef381ee876
SHA256

8c3f7744fbc3b8280a578436a1c58eb12308d58285ae554ffed9e38c3742126f
SHA512

4a7308a754b8c137f24475785b00b00ff8705cfe795a17fadec4fff3f472bd53d177e85bae09e6b3799b7c35a5365b122c1f1517dfc22b1b5f73453474e37a14
SSDEEP

1536:5aLuXE8XPIYyr7jvN0DoJ+cGgdLeAyNxnrz2/a6Bb:0LuXzXwYyr6DoocGceAy3ua6Bb

Score

7^/10

Deletes itself 1 IoCs

Processes:

Un_A.exe

pid process

3060 Un_A.exe
Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

3060 Un_A.exe
Loads dropped DLL 2 IoCs

Processes:

uninst.exeUn_A.exe

pid process

2036 uninst.exe
3060 Un_A.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3060	Un_A.exe

pid	process
3060	Un_A.exe

pid	process
2036	uninst.exe
3060	Un_A.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninst.exe

description	pid	process	target process
PID 2036 wrote to memory of 3060	2036	uninst.exe	Un_A.exe
PID 2036 wrote to memory of 3060	2036	uninst.exe	Un_A.exe
PID 2036 wrote to memory of 3060	2036	uninst.exe	Un_A.exe
PID 2036 wrote to memory of 3060	2036	uninst.exe	Un_A.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nstF3E.tmp\LangDLL.dll

Filesize
5KB

MD5
b26b412d9f1050ad53f663c972fdcd9f

SHA1
7bc4ed444f3f8fd14c2c36784d828175bace8c17

SHA256
70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a

SHA512
ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
64KB

MD5
96910c8a8d4b7ede90a59c90d105c511

SHA1
413e570bcb74495a7d4dd8b96ab64aef381ee876

SHA256
8c3f7744fbc3b8280a578436a1c58eb12308d58285ae554ffed9e38c3742126f

SHA512
4a7308a754b8c137f24475785b00b00ff8705cfe795a17fadec4fff3f472bd53d177e85bae09e6b3799b7c35a5365b122c1f1517dfc22b1b5f73453474e37a14

Download Submit