20f9fc2278fae267ea2b4711b0f043c85aff368faaeed5b0c3c483c11a699925

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 11:51

Target

Uninstall.exe
Size

53KB
MD5

2a6c7a4130c659029ff5ccedb7f94c2b
SHA1

17e6f9288fcfdf8810f70a8aba5a939eff3a973c
SHA256

514b76cfd9050f937c45bfd3c9c9f85c2c7be84e2f275af0c8a781e143cb6c39
SHA512

7ed874cb0f3c0a4458e5158b1f11f70ae16ce3fcfd057da9a2f192542267576eef7a22b93909cad0c067e9b0f56dfe1039d97bc01b734f4686f57d65cbc3a2d7
SSDEEP

1536:grsKlcypDv17knJGq90D2YzIIgdLeAyN0mJk:usKWy9v17kwBD2YzIIceASJk

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

3688 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3688	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 1640 wrote to memory of 3688	1640	Uninstall.exe	Au_.exe
PID 1640 wrote to memory of 3688	1640	Uninstall.exe	Au_.exe
PID 1640 wrote to memory of 3688	1640	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3596,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:4128

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Filesize
53KB

MD5
2a6c7a4130c659029ff5ccedb7f94c2b

SHA1
17e6f9288fcfdf8810f70a8aba5a939eff3a973c

SHA256
514b76cfd9050f937c45bfd3c9c9f85c2c7be84e2f275af0c8a781e143cb6c39

SHA512
7ed874cb0f3c0a4458e5158b1f11f70ae16ce3fcfd057da9a2f192542267576eef7a22b93909cad0c067e9b0f56dfe1039d97bc01b734f4686f57d65cbc3a2d7

Download Submit