06234c2ae5986e4fbdb15e8dd2012a7f46ae50bad5a0e0dc8576c99553664f01

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HA_UPXShell342_2020_chenmy/uninst.exe
Size

35KB
MD5

ed4834949ba14d1779c6ccdbcc68dab7
SHA1

0e126e293cb9af587773f745713be2c622af99c4
SHA256

a1090a3e24c9c2f99870748dc6607f960bf5e97a406fd96776ef55f96e12ee71
SHA512

6486e88ae564f7c675b240429e41b9e94cd07c0e7742ac85d6e6873d6e14bc82e4688aba71f4a572a8186db14139ce7d1352094c6c427dcc4081c6d56bf7e8e4
SSDEEP

768:R1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJcJRnTT:/QpQ5EP0ijnRTXJcT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1664	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1664	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2976	uninst.exe
1664	Au_.exe
1664	Au_.exe
1664	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28
PID 2976 wrote to memory of 1664	2976	uninst.exe	28

C:\Users\Admin\AppData\Local\Temp\HA_UPXShell342_2020_chenmy\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\HA_UPXShell342_2020_chenmy\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\HA_UPXShell342_2020_chenmy\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
35KB

MD5
ed4834949ba14d1779c6ccdbcc68dab7

SHA1
0e126e293cb9af587773f745713be2c622af99c4

SHA256
a1090a3e24c9c2f99870748dc6607f960bf5e97a406fd96776ef55f96e12ee71

SHA512
6486e88ae564f7c675b240429e41b9e94cd07c0e7742ac85d6e6873d6e14bc82e4688aba71f4a572a8186db14139ce7d1352094c6c427dcc4081c6d56bf7e8e4

Download Submit