e11ade8b94dbb5374102669ea589bc1072ea07b93897f3b36fa045f5192ef0ba

Resubmissions

11-07-2024 20:44

240711-zjbl5stbjk 7

11-07-2024 20:30

240711-y939easfqk 7

Analysis

max time kernel
451s
max time network
437s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
11-07-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall.exe
Size

55KB
MD5

8734b81542fd303b48b76d9dd32bffa5
SHA1

b541e27138f773cc0515670e8062cfc7405f18fe
SHA256

dd6f42a6a282d56e98eb8885f59453f0dad11494c27b38718c3f9b6aaf5d9170
SHA512

76d5e4688c9260dea0c4c96f64216ac45a7e088b3bc8c283a84dbe57d82e43814e574e2aaef530fd47f8d545df0bac86980471b2d91adf5027e8cdbf65cd3494
SSDEEP

1536:WrnHvdmBiuK8Uidw4TCRIuJw3uLbD875Yg1L7SYaw:knPdzuK8Jdw4TMJw3uLbS5Yg1fSYH

Score

5^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2988	Un.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	Un.exe

Loads dropped DLL 1 IoCs

pid	Process
2988	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.colpkg\	Un.exe
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.ankiaddon	Un.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.ankiaddon\	Un.exe
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.apkg	Un.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.apkg\	Un.exe
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\.colpkg	Un.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2988	1416	uninstall.exe	82
PID 1416 wrote to memory of 2988	1416	uninstall.exe	82
PID 1416 wrote to memory of 2988	1416	uninstall.exe	82

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstF4A3.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe

Filesize
55KB

MD5
8734b81542fd303b48b76d9dd32bffa5

SHA1
b541e27138f773cc0515670e8062cfc7405f18fe

SHA256
dd6f42a6a282d56e98eb8885f59453f0dad11494c27b38718c3f9b6aaf5d9170

SHA512
76d5e4688c9260dea0c4c96f64216ac45a7e088b3bc8c283a84dbe57d82e43814e574e2aaef530fd47f8d545df0bac86980471b2d91adf5027e8cdbf65cd3494

Download Submit