Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 00:48

General

  • Target

    Uninstall.exe

  • Size

    77KB

  • MD5

    ff11f586d42a888469164063c399d917

  • SHA1

    b3feded2344ea9a22035f628a441883c6216bf3e

  • SHA256

    869c31354b5c3f1c7586fec5c51270a606ca5210d4ea9df4a078a1d7bc62112e

  • SHA512

    573c35c9f066a2fbfba29d1cee5157b0d518d62210beb088d8c5380d43da4ee749a215ff76531e9ff59161a6449bdb44e3e0ee2ec4b18e03e0d36cbb131cbc86

  • SSDEEP

    1536:7iZU91Rzv4f/+LHgmpoM4sXJKTmdxQi5jaQkaB72/v97+N:7iezvrL9oMXJKatjIg639KN

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsjE18A.tmp\ioSpecial.ini

    Filesize

    589B

    MD5

    1083bd4a74115f2b028d80f28cb00997

    SHA1

    209e29888841a5e68b875dcd8dc851674ed7995e

    SHA256

    1f964d22efda3d3cb0ab78fe55be3b71c1222baabf201c5c4e7eba2dcfcf0abc

    SHA512

    5572cb296ab5e51a6e6f8ccca3a88e3a8dc8b07766cee598d9f2175c1a5887894496953036ed346485857abc9320abf84615a83e1deee495da4188ff3d415ffa

  • \Users\Admin\AppData\Local\Temp\nsjE18A.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    77KB

    MD5

    ff11f586d42a888469164063c399d917

    SHA1

    b3feded2344ea9a22035f628a441883c6216bf3e

    SHA256

    869c31354b5c3f1c7586fec5c51270a606ca5210d4ea9df4a078a1d7bc62112e

    SHA512

    573c35c9f066a2fbfba29d1cee5157b0d518d62210beb088d8c5380d43da4ee749a215ff76531e9ff59161a6449bdb44e3e0ee2ec4b18e03e0d36cbb131cbc86