702eb07e628655fab1007a045174aaa3a3e0a70025f7052fb12017280267ec6d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

119KB
MD5

5c393285f093c4970a3f3ab013a684b0
SHA1

125dee7089d4ebb6bebb7e140dc793a43e69e04c
SHA256

e559f5786d7d26a804380c60b56046e30bee54cccdbb1c359e560a672408b508
SHA512

98d99c258535bd52f4dfde6a06f85bc7528b21a2b34ac1ff657a290b01d7a38da21afc954ded08ab89793d518345c08191dd2670dc4f718d132e25bacb2e2ada
SSDEEP

3072:2k5+bFdkJHeNy4SqvntmsZ6nK1+tNI3RxahoU:n0O4Bvnz/+/qRAf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2260	A~NSISu_.exe

Loads dropped DLL 6 IoCs

pid	Process
1688	Uninstall.exe
2260	A~NSISu_.exe
2260	A~NSISu_.exe
2260	A~NSISu_.exe
2260	A~NSISu_.exe
2260	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral23/files/0x0036000000016103-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28
PID 1688 wrote to memory of 2260	1688	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso1D72.tmp\ioSpecial.ini

Filesize
607B

MD5
ebe3581a6f95c424c93dd7b046362409

SHA1
487898f4b8bf509212192f9dc85bebe516493b72

SHA256
d9cd11452029e986092b5d0db43594d61e3dbd9444f663f7eb45bc8f8f9e4e4b

SHA512
815dc60d1ff3739435d768fa1b08c46513cefea5670ceeac2f24c7e867d084edc5726420816b390fb3bac17167d718bb547ec2e27587bcbe3435f0bd83c79d9e

Download Submit
\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
119KB

MD5
5c393285f093c4970a3f3ab013a684b0

SHA1
125dee7089d4ebb6bebb7e140dc793a43e69e04c

SHA256
e559f5786d7d26a804380c60b56046e30bee54cccdbb1c359e560a672408b508

SHA512
98d99c258535bd52f4dfde6a06f85bc7528b21a2b34ac1ff657a290b01d7a38da21afc954ded08ab89793d518345c08191dd2670dc4f718d132e25bacb2e2ada

Download Submit
\Users\Admin\AppData\Local\Temp\nso1D72.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit
\Users\Admin\AppData\Local\Temp\nso1D72.tmp\UserInfo.dll

Filesize
4KB

MD5
593345196fcd1c553b0702cc026ccccd

SHA1
84446849c10e0c4d6683072f4c2eea5a085bac2f

SHA256
fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d

SHA512
b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads