d8aa2091ba067de919107cbed8ecf8826429107aa1a2f2558b2f24d86f282391

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

148KB
MD5

ac1987eb85b44e639f0cad7c0720086e
SHA1

22f3c6708cebe5a2b9c393c0340ae338e2539fbd
SHA256

54f5304e6f4261bc953722f44fc79765962dd4c5013ecac4fe931f98376fa4b4
SHA512

e892b2e6288aedae67566e2b078e5fb712efb2e6b852a2e9a1af58bf0f5b6e717983c463592e99fbda36409370752c4b98070fe7036542c9a04f4ec09d3f951b
SSDEEP

3072:gk5+bFdkJYYschIykPtTIJLDaDKvheeLJsDcbUeEPEiKKVKuU8:V0FWJnaDKv5LCgEcKnH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	A~NSISu_.exe

Loads dropped DLL 6 IoCs

pid	Process
2868	Uninstall.exe
2692	A~NSISu_.exe
2692	A~NSISu_.exe
2692	A~NSISu_.exe
2692	A~NSISu_.exe
2692	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral21/files/0x00050000000194cc-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30
PID 2868 wrote to memory of 2692	2868	Uninstall.exe	30

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso19BA.tmp\ioSpecial.ini

Filesize
655B

MD5
fce26fdb3037354e135174f633851cfe

SHA1
1367c4db1aad2cbdb1c72770a6289be4f52bca4b

SHA256
b532bc19a7b6b0096c9b26a7944c736ac49e33678f21e22de4520b74e4938f73

SHA512
136a23e4a64921339ba724b5266b5fbedaeefe18b6f1863b705570eb6747a1c9282f6e1be0f76a49d86cd9ad6fb43772d00841e33a3133d947d41a97114d8b22

Download Submit
\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
148KB

MD5
ac1987eb85b44e639f0cad7c0720086e

SHA1
22f3c6708cebe5a2b9c393c0340ae338e2539fbd

SHA256
54f5304e6f4261bc953722f44fc79765962dd4c5013ecac4fe931f98376fa4b4

SHA512
e892b2e6288aedae67566e2b078e5fb712efb2e6b852a2e9a1af58bf0f5b6e717983c463592e99fbda36409370752c4b98070fe7036542c9a04f4ec09d3f951b

Download Submit
\Users\Admin\AppData\Local\Temp\nso19BA.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit
\Users\Admin\AppData\Local\Temp\nso19BA.tmp\UserInfo.dll

Filesize
4KB

MD5
593345196fcd1c553b0702cc026ccccd

SHA1
84446849c10e0c4d6683072f4c2eea5a085bac2f

SHA256
fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d

SHA512
b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads