692878ac81e6439a2af9d3e558b4456a5abae4c029a196b62e8b5b316fd3571b

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 19:11

Target

gkamus-uninst.exe
Size

63KB
MD5

6305547a12e0e04228d42228ad6a504d
SHA1

f0b4d68c40a5738acc4ce718e14751d67446b165
SHA256

1e9db3d7ce31b8804ed9768621de21cd1144c0a1b8ed7e916eeb91dca13475de
SHA512

ad5a4aaca3d5b70c7a0f0dd82f4f71b5f80193411720ad8812ede6a3f996efb786309566c7f22c5beca2d1b1985ade15b7fb298d24d15333756e6fe183b42378
SSDEEP

1536:BmZw+QfiexLgJ/RQGcrnfDjuNgdLeAyN7BcT3hoVz:BmpQFx8/qGOnfDjuNceAYcF0

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2116 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2116	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

gkamus-uninst.exe

description	pid	process	target process
PID 4408 wrote to memory of 2116	4408	gkamus-uninst.exe	Au_.exe
PID 4408 wrote to memory of 2116	4408	gkamus-uninst.exe	Au_.exe
PID 4408 wrote to memory of 2116	4408	gkamus-uninst.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\gkamus-uninst.exe
"C:\Users\Admin\AppData\Local\Temp\gkamus-uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4408

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4024 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
Filesize
63KB

MD5
6305547a12e0e04228d42228ad6a504d

SHA1
f0b4d68c40a5738acc4ce718e14751d67446b165

SHA256
1e9db3d7ce31b8804ed9768621de21cd1144c0a1b8ed7e916eeb91dca13475de

SHA512
ad5a4aaca3d5b70c7a0f0dd82f4f71b5f80193411720ad8812ede6a3f996efb786309566c7f22c5beca2d1b1985ade15b7fb298d24d15333756e6fe183b42378

Download Submit