de8c8b9da365ddab4c02abcadaf9ccbf3f4b84c5ff5ea8daec4ee6165a66a68f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

124KB
MD5

0f98374016e2f3a77034ecf068624e89
SHA1

6c363894525531dfd2135d648cbd18341c0e0c53
SHA256

3958f341474249b0fc1772c46bf4b2a8f6531bea26caceb44ec5c6c7aa1619cb
SHA512

2d6e5e928a23767203c86a01e9cc9bad99e430d57175a71b7743deccd2b665dfa5e88e7614825709b446b107edef74fdb2cc5fcb9377723799b3c0e125459756
SSDEEP

3072:yLk395hYXJTS4Z+H22Zip6dmDHgG2ojdotyeILc:yQqI4ITsp6dAT2ojdoIeILc

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2808	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
2708	Uninstall.exe
2808	Au_.exe
2808	Au_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\iWinArcadeIECleanup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iWinArcadeAutocleanup.bat"	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iWinGames.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iWinTrusted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iWinGames.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral17/files/0x000500000001c8ab-2.dat	nsis_installer_1
behavioral17/files/0x000500000001c8ab-2.dat	nsis_installer_2

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software\Microsoft	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software\Microsoft\Windows	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\GameUX	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\GameUX\GamesToFindOnWindowsUpgrade	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Software	Au_.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	AdminWorker.exe
2412	AdminWorker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	Au_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	AdminWorker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1688	iWinGames.exe
2576	iWinGames.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2808	2708	Uninstall.exe	31
PID 2708 wrote to memory of 2808	2708	Uninstall.exe	31
PID 2708 wrote to memory of 2808	2708	Uninstall.exe	31
PID 2708 wrote to memory of 2808	2708	Uninstall.exe	31
PID 2808 wrote to memory of 2724	2808	Au_.exe	32
PID 2808 wrote to memory of 2724	2808	Au_.exe	32
PID 2808 wrote to memory of 2724	2808	Au_.exe	32
PID 2808 wrote to memory of 2724	2808	Au_.exe	32
PID 2808 wrote to memory of 1092	2808	Au_.exe	33
PID 2808 wrote to memory of 1092	2808	Au_.exe	33
PID 2808 wrote to memory of 1092	2808	Au_.exe	33
PID 2808 wrote to memory of 1092	2808	Au_.exe	33
PID 2808 wrote to memory of 2956	2808	Au_.exe	34
PID 2808 wrote to memory of 2956	2808	Au_.exe	34
PID 2808 wrote to memory of 2956	2808	Au_.exe	34
PID 2808 wrote to memory of 2956	2808	Au_.exe	34
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2808 wrote to memory of 2588	2808	Au_.exe	35
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2588 wrote to memory of 2288	2588	WebInstaller.exe	36
PID 2808 wrote to memory of 1688	2808	Au_.exe	37
PID 2808 wrote to memory of 1688	2808	Au_.exe	37
PID 2808 wrote to memory of 1688	2808	Au_.exe	37
PID 2808 wrote to memory of 1688	2808	Au_.exe	37
PID 2608 wrote to memory of 2576	2608	taskeng.exe	39
PID 2608 wrote to memory of 2576	2608	taskeng.exe	39
PID 2608 wrote to memory of 2576	2608	taskeng.exe	39
PID 2608 wrote to memory of 2576	2608	taskeng.exe	39
PID 2808 wrote to memory of 2180	2808	Au_.exe	40
PID 2808 wrote to memory of 2180	2808	Au_.exe	40
PID 2808 wrote to memory of 2180	2808	Au_.exe	40
PID 2808 wrote to memory of 2180	2808	Au_.exe	40
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2144	2808	Au_.exe	41
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2220	2808	Au_.exe	42
PID 2808 wrote to memory of 2412	2808	Au_.exe	43
PID 2808 wrote to memory of 2412	2808	Au_.exe	43
PID 2808 wrote to memory of 2412	2808	Au_.exe	43
PID 2808 wrote to memory of 2412	2808	Au_.exe	43

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
    "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" DelArcadeFromFireWallExceptions
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
    "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" convertShortcutsToLinks
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\iWinTrusted.exe
    "C:\Users\Admin\AppData\Local\Temp\iWinTrusted.exe" -remove
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\WebInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\WebInstaller.exe" -uninstall
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s /u "C:\Users\Admin\AppData\Local\Temp\iWinGamesHookIE.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\iWinGames.exe
    "C:\Users\Admin\AppData\Local\Temp\iWinGames.exe" /trackArcadeUninstall_reason_0
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
    "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" uninstallDesktopAlerts
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinGamesHookIE.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinInfo.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
    "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" KillProcess iWinGames.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2412

C:\Windows\system32\taskeng.exe
taskeng.exe {D8A18E86-8278-428F-BC7C-92904A32E198} S-1-5-21-1385883288-3042840365-2734249351-1000:RPXOCQRF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\iWinGames.exe
  C:\Users\Admin\AppData\Local\Temp\iWinGames.exe /trackArcadeUninstall_reason_0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iWinGames\iWinGames.log

Filesize
525B

MD5
cdc31fc71bba67bcbdf4efca208a96b3

SHA1
fac15637f48cd2d31db06b30f60ba3899613ec87

SHA256
67cb9703f0c3e4c6bca9000ebef46189d508e1ccc32e45f2c264375a742b9f55

SHA512
e8447eee7fca4ba58bda6092c4fdbdf7745257ff43ff972f9d39f51c4eca2af325fe2d2cd7fc530627054abc56ac1d6dbdb1414cdbdfad6aba96736a4de0c98f

Download Submit
\Users\Admin\AppData\Local\Temp\nst60A.tmp\GameuxInstallHelper.dll

Filesize
94KB

MD5
4d3ac88054df63fc810427bdaa96c458

SHA1
e4d554e03ba91f6b53a2a80253b339f56e303c94

SHA256
b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6

SHA512
d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54

Download Submit
\Users\Admin\AppData\Local\Temp\nst60A.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
124KB

MD5
0f98374016e2f3a77034ecf068624e89

SHA1
6c363894525531dfd2135d648cbd18341c0e0c53

SHA256
3958f341474249b0fc1772c46bf4b2a8f6531bea26caceb44ec5c6c7aa1619cb

SHA512
2d6e5e928a23767203c86a01e9cc9bad99e430d57175a71b7743deccd2b665dfa5e88e7614825709b446b107edef74fdb2cc5fcb9377723799b3c0e125459756

Download Submit