b860f598a2550bb42b2aa77aed81e106cd36c50975a71b8288871ae61482e7a0 | Triage

Analysis

max time kernel
139s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 19:57

Sharing

Report Analysis Logs

General

Target

$TEMP/A±äËÙÆ÷/uninstall.exe
Size

35KB
MD5

df01d76736107080fb48dd38bf110f0c
SHA1

1a51f3988cf4c60010ea8b0d9cf45d0427f3df38
SHA256

9dc0ad7de80ca7f5a61baa95eec4724104a9d20d12d36aa606406c90c50541c9
SHA512

284a30d831a59f505f28199182d514eac79f757b68defd249a90ee964a85b189cd2777c004d642303d7ed948caa3ebeed84b51c3a99f43286d1143b2a810ab23
SSDEEP

768:xE+BmrtvkC3kCERF57oTBQsuE2Ol3E3VLhg0rJsJRnmg:xZBCOCsoGXcERrJhg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	A~NSISu_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 4988	2640	uninstall.exe	91
PID 2640 wrote to memory of 4988	2640	uninstall.exe	91
PID 2640 wrote to memory of 4988	2640	uninstall.exe	91

C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$TEMP\A±äËÙÆ÷
  2⤵
  - Executes dropped EXE
  PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
35KB

MD5
df01d76736107080fb48dd38bf110f0c

SHA1
1a51f3988cf4c60010ea8b0d9cf45d0427f3df38

SHA256
9dc0ad7de80ca7f5a61baa95eec4724104a9d20d12d36aa606406c90c50541c9

SHA512
284a30d831a59f505f28199182d514eac79f757b68defd249a90ee964a85b189cd2777c004d642303d7ed948caa3ebeed84b51c3a99f43286d1143b2a810ab23

Download Submit