2b106ed1320ce74ec86f578d15864f6afe42738cd24279cd7e5e9dc10cc3279f

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:00

Target

$_2_/Uninstall.exe
Size

42KB
MD5

9787542432e07524484183fd2fa1a080
SHA1

77daa1bf84000621fd3929eb44b1069794c53b3b
SHA256

e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9
SHA512

66f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e
SSDEEP

768:/4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJDJRnhzwr:gLXB65939tY6HBg4sXJk

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

3056 Au_.exe
Loads dropped DLL 4 IoCs

Processes:

Uninstall.exeAu_.exe

pid process

2220 Uninstall.exe
3056 Au_.exe
3056 Au_.exe
3056 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3056	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe
PID 2220 wrote to memory of 3056	2220	Uninstall.exe	Au_.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
42KB

MD5
9787542432e07524484183fd2fa1a080

SHA1
77daa1bf84000621fd3929eb44b1069794c53b3b

SHA256
e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9

SHA512
66f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e

Download Submit