9009859cf651cfff3cc0303fc8387d91574f1d8639310576ab1e6167654f1e24

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:36

Target

$_2_/Uninstall.exe
Size

49KB
MD5

17af5ad873fc0b6920b16f41638c4465
SHA1

9430c70934d8f7db9fc87705d60f37f8ed2f743a
SHA256

8a340670d6126dbe07f1c41a2dd8652ef23387a6644e281f072c00c3d13ce2ef
SHA512

57cd4bc91c32194e4d64b27b9091e1bc43270b81e46b5dfc0a817066e230d8e37b57cb62e6d3bffaf886a33d53e266cb2d4a603f8bb6a78c42ed969f59123c5c
SSDEEP

768:3ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJIJRnvzwU:yZr0wirt3/aEecbsg4sXJ0

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2240 Au_.exe
Loads dropped DLL 4 IoCs

Processes:

Uninstall.exeAu_.exe

pid process

3068 Uninstall.exe
2240 Au_.exe
2240 Au_.exe
2240 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2240	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe
PID 3068 wrote to memory of 2240	3068	Uninstall.exe	Au_.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
49KB

MD5
17af5ad873fc0b6920b16f41638c4465

SHA1
9430c70934d8f7db9fc87705d60f37f8ed2f743a

SHA256
8a340670d6126dbe07f1c41a2dd8652ef23387a6644e281f072c00c3d13ce2ef

SHA512
57cd4bc91c32194e4d64b27b9091e1bc43270b81e46b5dfc0a817066e230d8e37b57cb62e6d3bffaf886a33d53e266cb2d4a603f8bb6a78c42ed969f59123c5c

Download Submit