1fd0eb5a0bde40999118afa7beb7e99d43ba60eeba41d3100c8af08c00dc3aa4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

88KB
MD5

e10da989e7299ad0a37591649a676881
SHA1

66494a8c3093e9a4a6026c2ad29615c8f8be1a1c
SHA256

fa5493c2c562c3431083155b9184d6e5ca54307f550fa03863eebb409ed339ae
SHA512

7fa1e6b829024439377813f54ce0bda1be3858df525d83293f6065fe783fca2fcac8c74d3d6e08665ebc258aeb5764f24f18f1b2dc75fe061e459d15695c7d39
SSDEEP

1536:Rt/XUS3ZQ9h5f90D5kJWHR83dIWXwyNLIAW35pSkeVS9XaxIdPar:R1mh5CD5kJAR8zXnLIA8p3eVS9Xu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	Au_.exe

Loads dropped DLL 6 IoCs

pid	Process
1636	Uninstall.exe
2388	Au_.exe
2388	Au_.exe
2388	Au_.exe
2388	Au_.exe
2388	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral17/files/0x00370000000164a9-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28
PID 1636 wrote to memory of 2388	1636	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy2C4F.tmp\ioSpecial.ini

Filesize
619B

MD5
4415b9e26b5b72cc48ae707bfa76cf03

SHA1
7e0a6e189e18dbbe7c2182d81465178d3a87c196

SHA256
75791bec12362efd5c2c7df8c3e8d307f797fcd6911f0cf8ad86d33ce8af9ffa

SHA512
dcc564411fac507451b0fd9cc9f7cb305740c4e4913ec1ac40eeef8833a3a0a88de162ae1fb3af792f7e9841b80f09c5bd8f6d322df925c79a2a90745d1386e7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C4F.tmp\InstallOptions.dll

Filesize
12KB

MD5
3c19f79ce11facc2fc4d3351dbb263e0

SHA1
17f4bf4b18ea7700f70ac7d825dc997be0d25f71

SHA256
cfaba712ad640ce2b4890005ffcf03ed9e2a18a6cf9075295f3aaea1478896b9

SHA512
05c9ac861e4fed610171fcb5fad40abc30cbf90e9c7cb13c758f52cdff568af0fdd6af968db4fb143a748c77f21c353c7cffea28cbcbd2ad17157038ab490273

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C4F.tmp\System.dll

Filesize
10KB

MD5
725145e8caa39635cab9899c47c72eda

SHA1
30478c907551bd920bf359638b091fc5c10b5a53

SHA256
1759e4f7777fb8c9ed356a7d4dc237a90e0760061685d44ea02d40ca9e359ceb

SHA512
de31286ea10321f762a3b6e7c6c82177d5b6f45a82adc936fcbbc23105708cbbbec903ba94ba94e7723e80f1828393e5395ef575b37136b19de7535e74e24547

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
88KB

MD5
e10da989e7299ad0a37591649a676881

SHA1
66494a8c3093e9a4a6026c2ad29615c8f8be1a1c

SHA256
fa5493c2c562c3431083155b9184d6e5ca54307f550fa03863eebb409ed339ae

SHA512
7fa1e6b829024439377813f54ce0bda1be3858df525d83293f6065fe783fca2fcac8c74d3d6e08665ebc258aeb5764f24f18f1b2dc75fe061e459d15695c7d39

Download Submit