Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 13:58

General

  • Target

    $1/$APPDATA/MediaPlayerApplication2/uninstaller.exe

  • Size

    39KB

  • MD5

    35f86495201e758774fa56984e98884a

  • SHA1

    e642a7b5ac6a0cf4c0bfca0fdac23d5d1b732d35

  • SHA256

    10aa89b9dc0e4271f928c08fa656eb94c967cf32c2beefc6b6ec637d326f22dc

  • SHA512

    8ec5e7b2b4611733c25c98a5ec5e4017b48ef3b3136b5d8989b499e5ff5acebca1375e511e172927b1b3cbfaccce273a4a7036824baf0b8ba5991fd172600aed

  • SSDEEP

    768:+JKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNupJRnQCe:qTdm9B9lYypfMXvugHQ0DbLiNu21

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$1\$APPDATA\MediaPlayerApplication2\uninstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\$1\$APPDATA\MediaPlayerApplication2\uninstaller.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$1\$APPDATA\MediaPlayerApplication2\
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

    Filesize

    39KB

    MD5

    35f86495201e758774fa56984e98884a

    SHA1

    e642a7b5ac6a0cf4c0bfca0fdac23d5d1b732d35

    SHA256

    10aa89b9dc0e4271f928c08fa656eb94c967cf32c2beefc6b6ec637d326f22dc

    SHA512

    8ec5e7b2b4611733c25c98a5ec5e4017b48ef3b3136b5d8989b499e5ff5acebca1375e511e172927b1b3cbfaccce273a4a7036824baf0b8ba5991fd172600aed