Analysis

  • max time kernel
    134s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 01:15

General

  • Target

    WindNinja-2.0.1/Uninstall.exe

  • Size

    49KB

  • MD5

    ed04f76422a68aa282da0adf017f1a96

  • SHA1

    63862b6d935ac184b4faef4649ac5be14ddf8505

  • SHA256

    9f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6

  • SHA512

    59f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255

  • SSDEEP

    1536:WwJOoN1oYaoZ5iV685XJPChgdLeAyNJzF:WwJ52Y7ZoH5XJahceAUF

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          49KB

          MD5

          ed04f76422a68aa282da0adf017f1a96

          SHA1

          63862b6d935ac184b4faef4649ac5be14ddf8505

          SHA256

          9f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6

          SHA512

          59f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255