b7bb9922fd0af19db91658460bc1cf64cc1fa982bf9fdfdf5179f9d36c279b26

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:20

Target

Uninstall.exe
Size

416KB
MD5

8bbb48271e72125c81102e34dbe82a2b
SHA1

bc82ac3e16fdf34606546e5c7a9b28518cf42333
SHA256

7a81702f64ad1e9f6e3209144589a43b9c396efd2506c1892024455de1ce1567
SHA512

9737543ef3ac989e8b4ceb5f77818d659d0423905646aaa835a91c2316ad9c6f8275261b2cf14d1d7fa7573fe93726e63565f95da8b518e49135ce3b04d34f07
SSDEEP

3072:9Lk395hYXJYJrPnfuQcRPvXeA3C2EEHRnOx:9QqqBPn3Cv3C8Hd8

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1892 Au_.exe
Loads dropped DLL 3 IoCs

Processes:

Au_.exe

pid process

1892 Au_.exe
1892 Au_.exe
1892 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1892	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 4664 wrote to memory of 1892	4664	Uninstall.exe	Au_.exe
PID 4664 wrote to memory of 1892	4664	Uninstall.exe	Au_.exe
PID 4664 wrote to memory of 1892	4664	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsu39DD.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu39DD.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
416KB

MD5
8bbb48271e72125c81102e34dbe82a2b

SHA1
bc82ac3e16fdf34606546e5c7a9b28518cf42333

SHA256
7a81702f64ad1e9f6e3209144589a43b9c396efd2506c1892024455de1ce1567

SHA512
9737543ef3ac989e8b4ceb5f77818d659d0423905646aaa835a91c2316ad9c6f8275261b2cf14d1d7fa7573fe93726e63565f95da8b518e49135ce3b04d34f07

Download Submit