47956348c95fc18492263d5dafb3433b725357c6c6bdd38f76987d03bc8855e6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

61KB
MD5

0690952cd68ba63fbe8c2d6c9907ff8b
SHA1

28a37eefbdc32d20db29b3c9d1bf1bd6f37906bd
SHA256

2eb18b817141486dcb462a29b98490987f7d6be1f01c8d6f1ceb9e1c9be120ab
SHA512

958b3827dfa2d3f103a5038a2bd1ea837e0c3d1fc8bae5262c524fc702e96848cdff4f1b0e653af8ea7d931d0db01e1bd7118b8e735e8ddc925695327318a439
SSDEEP

1536:zUqBWUSFNrdN90DukJdqAELVig9LlLaLEYdVN25+Qw:AGW3B+DukJMAI0QLsNzQw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2332	Uninstall.exe
1992	Au_.exe
1992	Au_.exe
1992	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral7/files/0x00090000000146a2-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28
PID 2332 wrote to memory of 1992	2332	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
61KB

MD5
0690952cd68ba63fbe8c2d6c9907ff8b

SHA1
28a37eefbdc32d20db29b3c9d1bf1bd6f37906bd

SHA256
2eb18b817141486dcb462a29b98490987f7d6be1f01c8d6f1ceb9e1c9be120ab

SHA512
958b3827dfa2d3f103a5038a2bd1ea837e0c3d1fc8bae5262c524fc702e96848cdff4f1b0e653af8ea7d931d0db01e1bd7118b8e735e8ddc925695327318a439

Download Submit