9009859cf651cfff3cc0303fc8387d91574f1d8639310576ab1e6167654f1e24

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:36

Target

$_2_/Uninstall.exe
Size

49KB
MD5

17af5ad873fc0b6920b16f41638c4465
SHA1

9430c70934d8f7db9fc87705d60f37f8ed2f743a
SHA256

8a340670d6126dbe07f1c41a2dd8652ef23387a6644e281f072c00c3d13ce2ef
SHA512

57cd4bc91c32194e4d64b27b9091e1bc43270b81e46b5dfc0a817066e230d8e37b57cb62e6d3bffaf886a33d53e266cb2d4a603f8bb6a78c42ed969f59123c5c
SSDEEP

768:3ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJIJRnvzwU:yZr0wirt3/aEecbsg4sXJ0

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

3480 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3480	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 2652 wrote to memory of 3480	2652	Uninstall.exe	Au_.exe
PID 2652 wrote to memory of 3480	2652	Uninstall.exe	Au_.exe
PID 2652 wrote to memory of 3480	2652	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$_2_\
2⤵
- Executes dropped EXE
PID:3480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
49KB

MD5
17af5ad873fc0b6920b16f41638c4465

SHA1
9430c70934d8f7db9fc87705d60f37f8ed2f743a

SHA256
8a340670d6126dbe07f1c41a2dd8652ef23387a6644e281f072c00c3d13ce2ef

SHA512
57cd4bc91c32194e4d64b27b9091e1bc43270b81e46b5dfc0a817066e230d8e37b57cb62e6d3bffaf886a33d53e266cb2d4a603f8bb6a78c42ed969f59123c5c

Download Submit