702eb07e628655fab1007a045174aaa3a3e0a70025f7052fb12017280267ec6d

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

119KB
MD5

5c393285f093c4970a3f3ab013a684b0
SHA1

125dee7089d4ebb6bebb7e140dc793a43e69e04c
SHA256

e559f5786d7d26a804380c60b56046e30bee54cccdbb1c359e560a672408b508
SHA512

98d99c258535bd52f4dfde6a06f85bc7528b21a2b34ac1ff657a290b01d7a38da21afc954ded08ab89793d518345c08191dd2670dc4f718d132e25bacb2e2ada
SSDEEP

3072:2k5+bFdkJHeNy4SqvntmsZ6nK1+tNI3RxahoU:n0O4Bvnz/+/qRAf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3260	A~NSISu_.exe

Loads dropped DLL 2 IoCs

pid	Process
3260	A~NSISu_.exe
3260	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral24/files/0x000800000002353d-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3260	4372	Uninstall.exe	88
PID 4372 wrote to memory of 3260	4372	Uninstall.exe	88
PID 4372 wrote to memory of 3260	4372	Uninstall.exe	88

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
119KB

MD5
5c393285f093c4970a3f3ab013a684b0

SHA1
125dee7089d4ebb6bebb7e140dc793a43e69e04c

SHA256
e559f5786d7d26a804380c60b56046e30bee54cccdbb1c359e560a672408b508

SHA512
98d99c258535bd52f4dfde6a06f85bc7528b21a2b34ac1ff657a290b01d7a38da21afc954ded08ab89793d518345c08191dd2670dc4f718d132e25bacb2e2ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseDCB6.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseDCB6.tmp\UserInfo.dll

Filesize
4KB

MD5
593345196fcd1c553b0702cc026ccccd

SHA1
84446849c10e0c4d6683072f4c2eea5a085bac2f

SHA256
fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d

SHA512
b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseDCB6.tmp\ioSpecial.ini

Filesize
607B

MD5
fde278ff6a3e0b51bb5994738a26ea7f

SHA1
8c7efdb9cc94f59a2a196b686cca679872799125

SHA256
55b48ac3b167c23b4fa56c39c3de0304b8d02620ec054e863b902c743a860d35

SHA512
64f9b030fab8ea63e7889c4896187978e693624620d32e8e0b0c267ca2f455775b3ebdf52a0ab0f9977cbf719526ba80053c1ecfe9f783ff485a7fcf0ad00360

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads