21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:42

Target

Uninstall.exe
Size

72KB
MD5

ada07b70b8db564ea7b0a26d13fb4129
SHA1

9c81f0c84989f36d55d48e7d3b0393c2b21b2acf
SHA256

7e78d44648f3be061a984b5ba00b2a6b9172c070f03c823b852a67d78a880ee5
SHA512

61f56d6c6df7c309a0358e5a767ea730a9a75090a1246fb49d32b762aa4ce21401bd2e8be7f45d9e6c5a015561ef9b2f345af6db415d795e2708373012fc7edd
SSDEEP

1536:GErPZ3IBZcbTfu1HlrJFCPcbPnbgdLeAyNZNsO49on0csK:9PC23aJFC0bPnbceAyl/n0K

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1664 Au_.exe
Loads dropped DLL 1 IoCs

Processes:

Uninstall.exe

pid process

2976 Uninstall.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Au_.exe

pid process

1664 Au_.exe

pid	process
1664	Au_.exe

pid	process
2976	Uninstall.exe

pid	process
1664	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 2976 wrote to memory of 1664	2976	Uninstall.exe	Au_.exe
PID 2976 wrote to memory of 1664	2976	Uninstall.exe	Au_.exe
PID 2976 wrote to memory of 1664	2976	Uninstall.exe	Au_.exe
PID 2976 wrote to memory of 1664	2976	Uninstall.exe	Au_.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
72KB

MD5
ada07b70b8db564ea7b0a26d13fb4129

SHA1
9c81f0c84989f36d55d48e7d3b0393c2b21b2acf

SHA256
7e78d44648f3be061a984b5ba00b2a6b9172c070f03c823b852a67d78a880ee5

SHA512
61f56d6c6df7c309a0358e5a767ea730a9a75090a1246fb49d32b762aa4ce21401bd2e8be7f45d9e6c5a015561ef9b2f345af6db415d795e2708373012fc7edd

Download Submit