23d18b987ed4162ab5fc624da3416a637b0f4c7451ccb4224be449e27b316c71

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$3/$APPDATA/QIPApp/uninstaller.exe
Size

40KB
MD5

833317595f14b577825dcbd67b865dfc
SHA1

6e06fd1f73d71826b8f609cd04293762a60f0bea
SHA256

1426647a213839e3b09778dabb8879eb2ff8881634b82a78c85017ff88d90e11
SHA512

7289335c3332174e7a876f7bbc86f00e98bef044d96c70214ec08e38afb855935195762952bc67d579fc6c3e59546d4319d971a148e24dd67351a1a6ddceaa2c
SSDEEP

768:UJKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNuoJRn1Ut:kTdm9B9lYypfMXvugHQ0DbLiNuYI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

1512 Un_A.exe
Loads dropped DLL 1 IoCs

Processes:

uninstaller.exe

pid process

552 uninstaller.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Un_A.exe

pid process

1512 Un_A.exe

pid	process
1512	Un_A.exe

pid	process
552	uninstaller.exe

pid	process
1512	Un_A.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninstaller.exe

description	pid	process	target process
PID 552 wrote to memory of 1512	552	uninstaller.exe	Un_A.exe
PID 552 wrote to memory of 1512	552	uninstaller.exe	Un_A.exe
PID 552 wrote to memory of 1512	552	uninstaller.exe	Un_A.exe
PID 552 wrote to memory of 1512	552	uninstaller.exe	Un_A.exe

C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\QIPApp\uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\QIPApp\uninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$3\$APPDATA\QIPApp\
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1512

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Filesize
40KB

MD5
833317595f14b577825dcbd67b865dfc

SHA1
6e06fd1f73d71826b8f609cd04293762a60f0bea

SHA256
1426647a213839e3b09778dabb8879eb2ff8881634b82a78c85017ff88d90e11

SHA512
7289335c3332174e7a876f7bbc86f00e98bef044d96c70214ec08e38afb855935195762952bc67d579fc6c3e59546d4319d971a148e24dd67351a1a6ddceaa2c

Download Submit