ff4bacc28cf6eb2e123bb9ef5fc818ace9f83c3c398d2d9ab78b80c224cdb7ba

Analysis

max time kernel
7s
max time network
29s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

70KB
MD5

7117ab480674b8aa780916265ed6db14
SHA1

216881c2e8a2c3298f9d251d5ac525760fedd59a
SHA256

9af1402ea961ecf470b7bb637bdd6e4497438fa95cbe2f13a6958e317fbec878
SHA512

946e60261a6e0fbe9fbab1157b364822eca015a597ac94dfa3e7eb5afb07b1b48ca190a1b310897b721d05ee4e09f976a72b9524e94c57b4b825b284314ab651
SSDEEP

1536:LcVxMtkyfWqPG1QIcVdWToWw2JqM9I3pR0tRTGCIXB:L4MrfWdbcDWToWNJ1920rTUB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2828	Un_A.exe

Loads dropped DLL 1 IoCs

pid	Process
1660	Uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29
PID 1660 wrote to memory of 2828	1660	Uninstall.exe	29

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Filesize
70KB

MD5
7117ab480674b8aa780916265ed6db14

SHA1
216881c2e8a2c3298f9d251d5ac525760fedd59a

SHA256
9af1402ea961ecf470b7bb637bdd6e4497438fa95cbe2f13a6958e317fbec878

SHA512
946e60261a6e0fbe9fbab1157b364822eca015a597ac94dfa3e7eb5afb07b1b48ca190a1b310897b721d05ee4e09f976a72b9524e94c57b4b825b284314ab651

Download Submit