f6bfbd33d1c687154a0405681f73c94047e048afeaf019592186ab6250e0a554

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

63KB
MD5

da3e2d085d45742d2c64916cc1aea8fa
SHA1

7d44d7e50823ceeb1c1cb36ad1cc0f8f07f7cca5
SHA256

a5f9683deec586553ea89ee56bc1170d7953c7fb7f5eb214b8ae475910279076
SHA512

898b75045756ad6794bd0704da3399cc6afd7cb4daa3ec65578b19dd2438c761feeded1300da756aa39e0ab9a88d5287ae4e2707053f9b27f80728bd83160ddf
SSDEEP

1536:lLXB65939tY6HBg4sXJhDX5mqfIIUl9XeoehZ:lLk395hYXJhDX5mqfI3SjZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2572	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	Uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral11/files/0x00220000000170cf-2.dat	nsis_installer_1
behavioral11/files/0x00220000000170cf-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2572	2180	Uninstall.exe	28
PID 2180 wrote to memory of 2572	2180	Uninstall.exe	28
PID 2180 wrote to memory of 2572	2180	Uninstall.exe	28
PID 2180 wrote to memory of 2572	2180	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
63KB

MD5
da3e2d085d45742d2c64916cc1aea8fa

SHA1
7d44d7e50823ceeb1c1cb36ad1cc0f8f07f7cca5

SHA256
a5f9683deec586553ea89ee56bc1170d7953c7fb7f5eb214b8ae475910279076

SHA512
898b75045756ad6794bd0704da3399cc6afd7cb4daa3ec65578b19dd2438c761feeded1300da756aa39e0ab9a88d5287ae4e2707053f9b27f80728bd83160ddf

Download Submit