38a979461cbcc16f88071177b01d294787ea9599245b3e95364d0bd1a1842fc3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uninstall_v2.exe
Size

71KB
MD5

cc0e6f9ae6d748d8783b1a723330bc35
SHA1

0471ba0f2eeb427dd199220f99711c49554c4999
SHA256

2e7cb045057f39e6c0f8a0801a2904874359c44c54bd73c5a295c4e6044ccd61
SHA512

3ce8299fbe4e16d978a9be5196d426149878b43a857f93cb7d723b3270ef0bfb1ce3a8279854ac81daa83464af3d8bf510c9c2b319330d9755423cd20ecc9de1
SSDEEP

1536:GRp4KfcDeQoCDq7Vr/jby5vbzbHCI6/auuM9I9hn2ylVD/djbRCf16:w4KUKQoCqUfbHCI6/DhuT7pBNCM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
2892	Uninstall_v2.exe
2300	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall_v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	Au_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2300	2892	Uninstall_v2.exe	30
PID 2892 wrote to memory of 2300	2892	Uninstall_v2.exe	30
PID 2892 wrote to memory of 2300	2892	Uninstall_v2.exe	30
PID 2892 wrote to memory of 2300	2892	Uninstall_v2.exe	30

C:\Users\Admin\AppData\Local\Temp\Uninstall_v2.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall_v2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy623D.tmp\ioSpecial.ini

Filesize
1KB

MD5
113bca5e426eb898f3d298846aeb529a

SHA1
fc0c3b3eb9f1a9459c109a4de8ab0b75b8eafcac

SHA256
b6d8b7273fa76806ae8cce38be1e0fd383bef35bd2110d4a74a7a4cf8ed5985b

SHA512
d62340aaf3814fc0eb09e4b34f0348e81583cab90a4c3a2df9c643bd746a09e658c076b019a34df042cef4a317bad568797cdd44d5f6359bd49a5a6e1cd9b5c9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy623D.tmp\InstallOptions.dll

Filesize
15KB

MD5
5e1b4d6318e6841bc05110ff2fffde08

SHA1
14fd68255e5992afa3affd35e9ad37a63207a8e7

SHA256
f527c375be190b78c063f95ec103cbac2e6c231ca28242f47d7b8771a4200fa5

SHA512
dc5f14b24590830a1588acb0360a6574cdd5a185772e93ab38116acb6e6744f42c85b134516cab470f736816c77691cb2c512ea9f79d0346d6eb789bc94eb538

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
71KB

MD5
cc0e6f9ae6d748d8783b1a723330bc35

SHA1
0471ba0f2eeb427dd199220f99711c49554c4999

SHA256
2e7cb045057f39e6c0f8a0801a2904874359c44c54bd73c5a295c4e6044ccd61

SHA512
3ce8299fbe4e16d978a9be5196d426149878b43a857f93cb7d723b3270ef0bfb1ce3a8279854ac81daa83464af3d8bf510c9c2b319330d9755423cd20ecc9de1

Download Submit