f680afa8207b8930f5bc4deedfe3331f5b79ed6f58790a83a04e692614eac552

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

139KB
MD5

ed1c562c19cf1b28368e3fe2de30ef4a
SHA1

5d7e6a441670f6275f6c57d36dfd7560a22b7745
SHA256

016d6577aa8cf4f336b538f04a520aa018a5b44fcefe947f904fb917fa6174ee
SHA512

5fac7ab25ae1623bfe518c8399106c90cd811bf5452139ffb15bd95a6d9d5de726106e295c6eb82949b5a0ec4838aa3c2e7b52301c86584c5f7a8db9a9a8169e
SSDEEP

3072:rk5+bFdkJeGQ/7PePsy5MiPzhqVHxSCGwJOy59G53bApcTkKTjG5:00x3beP5MiPVujzOy5QjY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	A~NSISu_.exe

Loads dropped DLL 5 IoCs

pid	Process
2056	Uninstall.exe
3040	A~NSISu_.exe
3040	A~NSISu_.exe
3040	A~NSISu_.exe
3040	A~NSISu_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral17/files/0x000500000001a4b7-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30
PID 2056 wrote to memory of 3040	2056	Uninstall.exe	30

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstBD39.tmp\ioSpecial.ini

Filesize
649B

MD5
614516f266eb956f7d357afcadf658dc

SHA1
8539428e8a58cc9f7a99bf541b906ae01f89cbb3

SHA256
e2e39cdd475c184bffad271a619d4c9ccd06262387e2501d2415fad333d9cea0

SHA512
e92c2e9bea72297a6121ee6f7d3245c498a26287ec27eba4f7cb82e9d782fbcade1c257c38cb9d4a101799b2ca656f55d1c545f6a996cb797ad122440589be7b

Download Submit
\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
139KB

MD5
ed1c562c19cf1b28368e3fe2de30ef4a

SHA1
5d7e6a441670f6275f6c57d36dfd7560a22b7745

SHA256
016d6577aa8cf4f336b538f04a520aa018a5b44fcefe947f904fb917fa6174ee

SHA512
5fac7ab25ae1623bfe518c8399106c90cd811bf5452139ffb15bd95a6d9d5de726106e295c6eb82949b5a0ec4838aa3c2e7b52301c86584c5f7a8db9a9a8169e

Download Submit
\Users\Admin\AppData\Local\Temp\nstBD39.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit