Overview
overview
7Static
static
3xp-AntiSpy...se.exe
windows7-x64
7xp-AntiSpy...se.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7xp-AntiSpy.chm
windows7-x64
1xp-AntiSpy.chm
windows10-2004-x64
1xp-AntiSpy.exe
windows7-x64
3xp-AntiSpy.exe
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
xp-AntiSpy_setup-simplified-chinese.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
xp-AntiSpy_setup-simplified-chinese.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
xp-AntiSpy.chm
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
xp-AntiSpy.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
xp-AntiSpy.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
xp-AntiSpy.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
Uninstall.exe
-
Size
66KB
-
MD5
0fe54ab73b704ddb0462a11f6cb2e24f
-
SHA1
5b063f7a886d83a972172cd19c90ad09d980da0e
-
SHA256
2dbbb592dcb26ed520e6241553b0f59cff0ed805e1dbfbaed2891c5d59583e44
-
SHA512
03420d3d6eac8fe59f5791ad94877043422239f3f46b16c045b9133b81f036bb4c729466be5cbfb8a611147e18a81640f6cb95e963ba6116241a5a7d2387d60e
-
SSDEEP
768:/r9PAmQk+vuJlRYnQ5+lG0eIFodAQ3rFS6sWkJHCPNOQc142FtWwSICP8nn3gYRC:TVPH+sliQMJHSbkJiPUQcREYRN7k
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2756 Au_.exe -
Loads dropped DLL 4 IoCs
pid Process 2688 Uninstall.exe 2756 Au_.exe 2756 Au_.exe 2756 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral7/files/0x0006000000016d04-2.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2756 Au_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30 PID 2688 wrote to memory of 2756 2688 Uninstall.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD50fe54ab73b704ddb0462a11f6cb2e24f
SHA15b063f7a886d83a972172cd19c90ad09d980da0e
SHA2562dbbb592dcb26ed520e6241553b0f59cff0ed805e1dbfbaed2891c5d59583e44
SHA51203420d3d6eac8fe59f5791ad94877043422239f3f46b16c045b9133b81f036bb4c729466be5cbfb8a611147e18a81640f6cb95e963ba6116241a5a7d2387d60e