2b106ed1320ce74ec86f578d15864f6afe42738cd24279cd7e5e9dc10cc3279f

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:00

Target

$_2_/Uninstall.exe
Size

42KB
MD5

9787542432e07524484183fd2fa1a080
SHA1

77daa1bf84000621fd3929eb44b1069794c53b3b
SHA256

e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9
SHA512

66f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e
SSDEEP

768:/4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJDJRnhzwr:gLXB65939tY6HBg4sXJk

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

5016 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5016	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 668 wrote to memory of 5016	668	Uninstall.exe	Au_.exe
PID 668 wrote to memory of 5016	668	Uninstall.exe	Au_.exe
PID 668 wrote to memory of 5016	668	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$_2_\
2⤵
- Executes dropped EXE
PID:5016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Filesize
42KB

MD5
9787542432e07524484183fd2fa1a080

SHA1
77daa1bf84000621fd3929eb44b1069794c53b3b

SHA256
e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9

SHA512
66f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e

Download Submit