6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

85KB
MD5

1051242fb44103a5534ff0356c1b00fb
SHA1

513bf55b6813bd9ff19ca7bf2b6979a3ef8b5b1d
SHA256

a5d85bfcb4373db41295deef8d54f4591edf69403d6bb709a5ccd861455d1af7
SHA512

54670c286816ab9b853eaad0ca928e69e061eb233fa3979c2dd37fae379e50a4cc86f67504c2b0205df23c30ef2218edd23ba68caa72c5495aeeeb338728f74a
SSDEEP

1536:QCaIoX1oYOcbTMV88TXJLEDnnrmnx36FPhjtxQsOk63dcBuX6gSzR/7N:QCaZ2Yrb0VTXJYDnqxwZWX3we6Z9R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

1472 Au_.exe
Loads dropped DLL 3 IoCs

Processes:

Au_.exe

pid process

1472 Au_.exe
1472 Au_.exe
1472 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1472	Au_.exe

pid	process
1472	Au_.exe
1472	Au_.exe
1472	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Uninstall.exe

description	pid	process	target process
PID 1904 wrote to memory of 1472	1904	Uninstall.exe	Au_.exe
PID 1904 wrote to memory of 1472	1904	Uninstall.exe	Au_.exe
PID 1904 wrote to memory of 1472	1904	Uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw16DF.tmp\InstallOptions.dll
Filesize
14KB

MD5
714e0ecd29f9ec555f350f38672726c7

SHA1
555b1492e782d7a30f280f2aecb64c642c1aaad3

SHA256
21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3

SHA512
ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw16DF.tmp\System.dll
Filesize
11KB

MD5
960a5c48e25cf2bca332e74e11d825c9

SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876

SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw16DF.tmp\ioSpecial.ini
Filesize
572B

MD5
adbe522982cf833f15829c71049e5ccc

SHA1
d4eb95ffb306a1d0c4b3d969650910d7e932e88d

SHA256
71f7fc0cb69e69330e227e3ae688a7619e74d23887036e2b5517227f73df0502

SHA512
8af15d4c9e4e3a22608622c366dc26e9d0fe7e246fd2faec5f047cbfe94694c3bba0e730277e7e394509c2341b5086bb9a12222fc922823dd4a79cdabebdb203

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Filesize
85KB

MD5
1051242fb44103a5534ff0356c1b00fb

SHA1
513bf55b6813bd9ff19ca7bf2b6979a3ef8b5b1d

SHA256
a5d85bfcb4373db41295deef8d54f4591edf69403d6bb709a5ccd861455d1af7

SHA512
54670c286816ab9b853eaad0ca928e69e061eb233fa3979c2dd37fae379e50a4cc86f67504c2b0205df23c30ef2218edd23ba68caa72c5495aeeeb338728f74a

Download Submit