21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:42

Target

Uninstall.exe
Size

72KB
MD5

ada07b70b8db564ea7b0a26d13fb4129
SHA1

9c81f0c84989f36d55d48e7d3b0393c2b21b2acf
SHA256

7e78d44648f3be061a984b5ba00b2a6b9172c070f03c823b852a67d78a880ee5
SHA512

61f56d6c6df7c309a0358e5a767ea730a9a75090a1246fb49d32b762aa4ce21401bd2e8be7f45d9e6c5a015561ef9b2f345af6db415d795e2708373012fc7edd
SSDEEP

1536:GErPZ3IBZcbTfu1HlrJFCPcbPnbgdLeAyNZNsO49on0csK:9PC23aJFC0bPnbceAyl/n0K

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2064 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2064	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 1688 wrote to memory of 2064	1688	Uninstall.exe	Au_.exe
PID 1688 wrote to memory of 2064	1688	Uninstall.exe	Au_.exe
PID 1688 wrote to memory of 2064	1688	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:2228

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
72KB

MD5
ada07b70b8db564ea7b0a26d13fb4129

SHA1
9c81f0c84989f36d55d48e7d3b0393c2b21b2acf

SHA256
7e78d44648f3be061a984b5ba00b2a6b9172c070f03c823b852a67d78a880ee5

SHA512
61f56d6c6df7c309a0358e5a767ea730a9a75090a1246fb49d32b762aa4ce21401bd2e8be7f45d9e6c5a015561ef9b2f345af6db415d795e2708373012fc7edd

Download Submit