d88e7a747d4889013c3b2eea2a99d28f4a559d8801296906476d8475a1967fda

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:44

Target

Uninst.exe
Size

64KB
MD5

a1e93c9da52a01233f8459b155085f71
SHA1

f86ec9d4d33f4be172d8d7508476b5e5dcad2dee
SHA256

5c50613ff2f0bdfda5c829eca69717fc5b9ac7a77dd1bbaa5d46c6ac13820046
SHA512

9906f18a92d59dda40391fc541b3745f025d299be3ae8798cee18633664c2b5c79539b29ce5014904dc96898e115e7335aaa20bdb15e95a5656a0d64c91e72cc
SSDEEP

1536:tLXB65939tY6HBg4sXJ0d7EE/1s2SXiMl5Dovxj+h3:tLk395hYXJGEE9s2giM0vxj+h3

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
804	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
804	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral22/files/0x0008000000023561-4.dat	nsis_installer_1
behavioral22/files/0x0008000000023561-4.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
804	Au_.exe
804	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 804	4344	Uninst.exe	83
PID 4344 wrote to memory of 804	4344	Uninst.exe	83
PID 4344 wrote to memory of 804	4344	Uninst.exe	83

C:\Users\Admin\AppData\Local\Temp\Uninst.exe
"C:\Users\Admin\AppData\Local\Temp\Uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:804

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsu38F3.tmp\Processes.dll

Filesize
35KB

MD5
2cfba79d485cf441c646dd40d82490fc

SHA1
83e51ac1115a50986ed456bd18729653018b9619

SHA256
86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7

SHA512
cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
64KB

MD5
a1e93c9da52a01233f8459b155085f71

SHA1
f86ec9d4d33f4be172d8d7508476b5e5dcad2dee

SHA256
5c50613ff2f0bdfda5c829eca69717fc5b9ac7a77dd1bbaa5d46c6ac13820046

SHA512
9906f18a92d59dda40391fc541b3745f025d299be3ae8798cee18633664c2b5c79539b29ce5014904dc96898e115e7335aaa20bdb15e95a5656a0d64c91e72cc

Download Submit