898ca7aa129126a615282db699c2c3545f05df4c5660ee16bd9b42913ff5818f

Analysis

max time kernel
138s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_14_/Uninstall.exe
Size

109KB
MD5

e129b8a705222e47225ffbb76d9724d5
SHA1

325920cdc1ddf65d74a74dca9dfde15e4835b7f6
SHA256

2f7fd012284edcff658f512dead1bc539eb1490421137d54a363728199fffcf8
SHA512

52d782f2698c4324b5dc8374af46ca1c369920b79942f0c55cb3c62e1876455658c75542ab1dffd5ab81c2ce213cc3a42f633938b666145f3f55fed7a5bfefd2
SSDEEP

3072:74lLpkXGED3iNuQZndILLBR147AcQOBjUirY:ApkXGhz7uHWbM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4556	Un_A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4556	2692	Uninstall.exe	82
PID 2692 wrote to memory of 4556	2692	Uninstall.exe	82
PID 2692 wrote to memory of 4556	2692	Uninstall.exe	82

C:\Users\Admin\AppData\Local\Temp\$_14_\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$_14_\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$_14_\
  2⤵
  - Executes dropped EXE
  PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
109KB

MD5
e129b8a705222e47225ffbb76d9724d5

SHA1
325920cdc1ddf65d74a74dca9dfde15e4835b7f6

SHA256
2f7fd012284edcff658f512dead1bc539eb1490421137d54a363728199fffcf8

SHA512
52d782f2698c4324b5dc8374af46ca1c369920b79942f0c55cb3c62e1876455658c75542ab1dffd5ab81c2ce213cc3a42f633938b666145f3f55fed7a5bfefd2

Download Submit