525a2eb43f2a4c702213723541335dc0391b42a01177e1faf5873e0cb7540ce0

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 09:27

Target

uninstall.exe
Size

37KB
MD5

078daf9669ef12a368f1aed5a21b1cd1
SHA1

fc4d9a58d42089d6e7c42f45b92d87f978958dea
SHA256

0a91e2fab1de979c8bd0816c5a709deb7bdb80a198c9163d58a5ce377607fb9d
SHA512

7a18dcf41e30278cc1348c51ad904f9024dd431c48faa576484f8b189e53bccffade0a94563d0bf76fb07a0cbdc6033dec95ec8f1ad59c32518967b8d59df30d
SSDEEP

768:FaKoIAEPaXHQe5cDOnLT6OSKQGg1qtOqGVfmMk0D3/jIp3KlcEJRnYlCd8:UKJAES3bS2L6KbuVfmMk0DCwctlCd8

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid process

2768 Au_.exe
Loads dropped DLL 1 IoCs

Processes:

uninstall.exe

pid process

2424 uninstall.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2768	Au_.exe

pid	process
2424	uninstall.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

uninstall.exe

description	pid	process	target process
PID 2424 wrote to memory of 2768	2424	uninstall.exe	Au_.exe
PID 2424 wrote to memory of 2768	2424	uninstall.exe	Au_.exe
PID 2424 wrote to memory of 2768	2424	uninstall.exe	Au_.exe
PID 2424 wrote to memory of 2768	2424	uninstall.exe	Au_.exe

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:2768

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Filesize
37KB

MD5
078daf9669ef12a368f1aed5a21b1cd1

SHA1
fc4d9a58d42089d6e7c42f45b92d87f978958dea

SHA256
0a91e2fab1de979c8bd0816c5a709deb7bdb80a198c9163d58a5ce377607fb9d

SHA512
7a18dcf41e30278cc1348c51ad904f9024dd431c48faa576484f8b189e53bccffade0a94563d0bf76fb07a0cbdc6033dec95ec8f1ad59c32518967b8d59df30d

Download Submit