3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 08:55

Sharing

Report Analysis Logs

General

Target

uninst.exe
Size

64KB
MD5

d9ede82a6ff2ebd2fe6681dfe6a9d3d9
SHA1

3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e
SHA256

f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506
SHA512

b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e
SSDEEP

1536:OWbXhuGWZzJkAKqQxenkJnuQcREYRNtuUBXn:OkxuGW5Jk33xenkJnrq3Rn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2536	uninst.exe
2392	Au_.exe
2392	Au_.exe
2392	Au_.exe

NSIS installer 1 IoCs

resource	yara_rule
behavioral31/files/0x000500000001a54b-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30
PID 2536 wrote to memory of 2392	2536	uninst.exe	30

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
64KB

MD5
d9ede82a6ff2ebd2fe6681dfe6a9d3d9

SHA1
3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e

SHA256
f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506

SHA512
b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e

Download Submit