b860f598a2550bb42b2aa77aed81e106cd36c50975a71b8288871ae61482e7a0 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:57

Sharing

Report Analysis Logs

General

Target

$TEMP/A±äËÙÆ÷/uninstall.exe
Size

35KB
MD5

df01d76736107080fb48dd38bf110f0c
SHA1

1a51f3988cf4c60010ea8b0d9cf45d0427f3df38
SHA256

9dc0ad7de80ca7f5a61baa95eec4724104a9d20d12d36aa606406c90c50541c9
SHA512

284a30d831a59f505f28199182d514eac79f757b68defd249a90ee964a85b189cd2777c004d642303d7ed948caa3ebeed84b51c3a99f43286d1143b2a810ab23
SSDEEP

768:xE+BmrtvkC3kCERF57oTBQsuE2Ol3E3VLhg0rJsJRnmg:xZBCOCsoGXcERrJhg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1092	A~NSISu_.exe

Loads dropped DLL 4 IoCs

pid	Process
1452	uninstall.exe
1092	A~NSISu_.exe
1092	A~NSISu_.exe
1092	A~NSISu_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28
PID 1452 wrote to memory of 1092	1452	uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
35KB

MD5
df01d76736107080fb48dd38bf110f0c

SHA1
1a51f3988cf4c60010ea8b0d9cf45d0427f3df38

SHA256
9dc0ad7de80ca7f5a61baa95eec4724104a9d20d12d36aa606406c90c50541c9

SHA512
284a30d831a59f505f28199182d514eac79f757b68defd249a90ee964a85b189cd2777c004d642303d7ed948caa3ebeed84b51c3a99f43286d1143b2a810ab23

Download Submit