Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-05-2024 18:04

General

  • Target

    Uninstall.exe

  • Size

    70KB

  • MD5

    e4cd221c4e43b554715b0a8a57434a46

  • SHA1

    4f07d920d8fe3bd614cc229f114b312f26013880

  • SHA256

    16a3798c80a0dd793b583892535687b0ce2e10ff10675ae159fe6d42fa17aeea

  • SHA512

    ef54ddaab0ac420fe868d089a1f8d08134802bcf192070ad1e87236836d5c5a04037daf6f862d7c9b116b3863347969cc0fa1ee76260eb4621760015900e6725

  • SSDEEP

    1536:WrsKlcypDv17knJGq90D2YzI2gdLeAyNLEVXNUTqjyfcra:ksKWy9v17kwBD2YzI2ceArVXu+Maa

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    Filesize

    70KB

    MD5

    e4cd221c4e43b554715b0a8a57434a46

    SHA1

    4f07d920d8fe3bd614cc229f114b312f26013880

    SHA256

    16a3798c80a0dd793b583892535687b0ce2e10ff10675ae159fe6d42fa17aeea

    SHA512

    ef54ddaab0ac420fe868d089a1f8d08134802bcf192070ad1e87236836d5c5a04037daf6f862d7c9b116b3863347969cc0fa1ee76260eb4621760015900e6725