898ca7aa129126a615282db699c2c3545f05df4c5660ee16bd9b42913ff5818f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_14_/Uninstall.exe
Size

109KB
MD5

e129b8a705222e47225ffbb76d9724d5
SHA1

325920cdc1ddf65d74a74dca9dfde15e4835b7f6
SHA256

2f7fd012284edcff658f512dead1bc539eb1490421137d54a363728199fffcf8
SHA512

52d782f2698c4324b5dc8374af46ca1c369920b79942f0c55cb3c62e1876455658c75542ab1dffd5ab81c2ce213cc3a42f633938b666145f3f55fed7a5bfefd2
SSDEEP

3072:74lLpkXGED3iNuQZndILLBR147AcQOBjUirY:ApkXGhz7uHWbM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2144	Un_A.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	Uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28
PID 2700 wrote to memory of 2144	2700	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\$_14_\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$_14_\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$_14_\
  2⤵
  - Executes dropped EXE
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
109KB

MD5
e129b8a705222e47225ffbb76d9724d5

SHA1
325920cdc1ddf65d74a74dca9dfde15e4835b7f6

SHA256
2f7fd012284edcff658f512dead1bc539eb1490421137d54a363728199fffcf8

SHA512
52d782f2698c4324b5dc8374af46ca1c369920b79942f0c55cb3c62e1876455658c75542ab1dffd5ab81c2ce213cc3a42f633938b666145f3f55fed7a5bfefd2

Download Submit