Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14-08-2024 16:01

General

  • Target

    $0/uninstall.exe

  • Size

    83KB

  • MD5

    b8581e4563421179a21eb5f9daff2380

  • SHA1

    99531598663bfaf0acd2e656532d9df44a69e4f3

  • SHA256

    79334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23

  • SHA512

    800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33

  • SSDEEP

    1536:6EkjY1zy214Qay0DGkJ7qAELVigJU4cp9iCxVF97d2/D8q:BkjAJ4dDGkJ+AI0bxvxVDQ/F

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsjC2C4.tmp\ioSpecial.ini

    Filesize

    736B

    MD5

    c8db75538ba2c4824e2313e3cdf8d06a

    SHA1

    df2fec0cce9c86112b588dc705efc565c105bc30

    SHA256

    b10014bd315900946e134d7086985272b4c4c360c94868fe49e8fb312f80bcf0

    SHA512

    2a8e8ff7faf1955c1113d82943df6cb326f6a8afc5d4b82bac2138f888e0036d8bb17bc9986635a17aa4016002ccaf53d7c213166819d819ef896487102469bb

  • \Users\Admin\AppData\Local\Temp\nsjC2C4.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • \Users\Admin\AppData\Local\Temp\nsjC2C4.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    83KB

    MD5

    b8581e4563421179a21eb5f9daff2380

    SHA1

    99531598663bfaf0acd2e656532d9df44a69e4f3

    SHA256

    79334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23

    SHA512

    800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33