f680afa8207b8930f5bc4deedfe3331f5b79ed6f58790a83a04e692614eac552

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall.exe
Size

139KB
MD5

ed1c562c19cf1b28368e3fe2de30ef4a
SHA1

5d7e6a441670f6275f6c57d36dfd7560a22b7745
SHA256

016d6577aa8cf4f336b538f04a520aa018a5b44fcefe947f904fb917fa6174ee
SHA512

5fac7ab25ae1623bfe518c8399106c90cd811bf5452139ffb15bd95a6d9d5de726106e295c6eb82949b5a0ec4838aa3c2e7b52301c86584c5f7a8db9a9a8169e
SSDEEP

3072:rk5+bFdkJeGQ/7PePsy5MiPzhqVHxSCGwJOy59G53bApcTkKTjG5:00x3beP5MiPVujzOy5QjY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
956	A~NSISu_.exe

Loads dropped DLL 1 IoCs

pid	Process
956	A~NSISu_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A~NSISu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral18/files/0x00070000000234a0-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 956	3036	Uninstall.exe	84
PID 3036 wrote to memory of 956	3036	Uninstall.exe	84
PID 3036 wrote to memory of 956	3036	Uninstall.exe	84

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
139KB

MD5
ed1c562c19cf1b28368e3fe2de30ef4a

SHA1
5d7e6a441670f6275f6c57d36dfd7560a22b7745

SHA256
016d6577aa8cf4f336b538f04a520aa018a5b44fcefe947f904fb917fa6174ee

SHA512
5fac7ab25ae1623bfe518c8399106c90cd811bf5452139ffb15bd95a6d9d5de726106e295c6eb82949b5a0ec4838aa3c2e7b52301c86584c5f7a8db9a9a8169e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa8678.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa8678.tmp\ioSpecial.ini

Filesize
649B

MD5
30483729c6027ed69c2b53b3efdb9ffc

SHA1
a6b150382c892117cc7f9e088b6af43f212f893e

SHA256
5b6647b81a32e19ea018edb228c0c6d38d0795458cd9e605be45beaef0b1dd25

SHA512
268c74661253a3be6f2b64f9c1b03079db1a8f04ada450f4fafedb3db342c8bff65012635472979b9835a445c31cde9c95dde2ee352230fba04173495bf15293

Download Submit