1532cff698afb7db96eb5094a4bc6882287293dfc1b2098b9f5c6f083b2afb40

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 20:53

Target

uninst.exe
Size

67KB
MD5

1cb18abc45f390b074657349a12d3a54
SHA1

107fcb19fd84036b9ab6bf0ec77a13a20972648f
SHA256

9a5b9267e6b6623a1bc26d6b78955d7fa6b2f9d9070d37044072ab69bee08e52
SHA512

940dd3029a9df9a18f71fbed7f5538edeadc54d544981dd0f4bcecb49f4c8ba741b08f10b4ea93e309e166f28f7f0b11e4003e163afcd5efe32223ba1ed19a8e
SSDEEP

1536:WRhoEXBpnbfRpQmJm9oECy3lvUyS1vg3XTsJLYKR:WjJ7nbppQmJaoEx1vE1vg3XTsJsKR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1232	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
1232	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	Au_.exe
1232	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1232	4208	uninst.exe	81
PID 4208 wrote to memory of 1232	4208	uninst.exe	81
PID 4208 wrote to memory of 1232	4208	uninst.exe	81

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsb4A0A.tmp\FindProcDLL.dll

Filesize
31KB

MD5
83cd62eab980e3d64c131799608c8371

SHA1
5b57a6842a154997e31fab573c5754b358f5dd1c

SHA256
a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

SHA512
91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
67KB

MD5
1cb18abc45f390b074657349a12d3a54

SHA1
107fcb19fd84036b9ab6bf0ec77a13a20972648f

SHA256
9a5b9267e6b6623a1bc26d6b78955d7fa6b2f9d9070d37044072ab69bee08e52

SHA512
940dd3029a9df9a18f71fbed7f5538edeadc54d544981dd0f4bcecb49f4c8ba741b08f10b4ea93e309e166f28f7f0b11e4003e163afcd5efe32223ba1ed19a8e

Download Submit