525a2eb43f2a4c702213723541335dc0391b42a01177e1faf5873e0cb7540ce0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 09:27

Target

uninstall.exe
Size

37KB
MD5

078daf9669ef12a368f1aed5a21b1cd1
SHA1

fc4d9a58d42089d6e7c42f45b92d87f978958dea
SHA256

0a91e2fab1de979c8bd0816c5a709deb7bdb80a198c9163d58a5ce377607fb9d
SHA512

7a18dcf41e30278cc1348c51ad904f9024dd431c48faa576484f8b189e53bccffade0a94563d0bf76fb07a0cbdc6033dec95ec8f1ad59c32518967b8d59df30d
SSDEEP

768:FaKoIAEPaXHQe5cDOnLT6OSKQGg1qtOqGVfmMk0D3/jIp3KlcEJRnYlCd8:UKJAES3bS2L6KbuVfmMk0DCwctlCd8

Score

7^/10

Deletes itself 1 IoCs

Processes:

Au_.exe

pid process

2732 Au_.exe
Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2732 Au_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2732	Au_.exe

pid	process
2732	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 2332 wrote to memory of 2732	2332	uninstall.exe	Au_.exe
PID 2332 wrote to memory of 2732	2332	uninstall.exe	Au_.exe
PID 2332 wrote to memory of 2732	2332	uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2732

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Filesize
37KB

MD5
078daf9669ef12a368f1aed5a21b1cd1

SHA1
fc4d9a58d42089d6e7c42f45b92d87f978958dea

SHA256
0a91e2fab1de979c8bd0816c5a709deb7bdb80a198c9163d58a5ce377607fb9d

SHA512
7a18dcf41e30278cc1348c51ad904f9024dd431c48faa576484f8b189e53bccffade0a94563d0bf76fb07a0cbdc6033dec95ec8f1ad59c32518967b8d59df30d

Download Submit