5ffbf12675bb0a3af407a83e83d85adee93e4fb76154f43340963d4f621a9a43

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe
Size

114KB
MD5

0c5e0c1938a61e766b0d1eb1cb61b248
SHA1

803d60b911f72dda2b258bd31d1218bb2e87f846
SHA256

d57bf93792c6f72b1fdac46cec3d9d6a53455762604cc16539dec4066c0eb81b
SHA512

14e12b18050249f707e421b416670d7d1bfda6cea1c219db801693c7c2be3da2ca04aceeab78f395821781549cde9e7c8941d06dfeae42cb83811426ce3fab19
SSDEEP

3072:aQIURTXJEo7Qgws+DZ0FpIqXFPlhTYFmorDvZ2Jp0jdztrr98OKqTVWYfNVXtH7t:ast7Qgws+DZ0FpIqXFPlhTYFmorDvZ2M

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2336	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral24/files/0x00070000000234b0-4.dat	nsis_installer_1
behavioral24/files/0x00070000000234b0-4.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 2336	3896	uninst.exe	85
PID 3896 wrote to memory of 2336	3896	uninst.exe	85
PID 3896 wrote to memory of 2336	3896	uninst.exe	85

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
114KB

MD5
0c5e0c1938a61e766b0d1eb1cb61b248

SHA1
803d60b911f72dda2b258bd31d1218bb2e87f846

SHA256
d57bf93792c6f72b1fdac46cec3d9d6a53455762604cc16539dec4066c0eb81b

SHA512
14e12b18050249f707e421b416670d7d1bfda6cea1c219db801693c7c2be3da2ca04aceeab78f395821781549cde9e7c8941d06dfeae42cb83811426ce3fab19

Download Submit