1dc7a2a9342ad70698ea3358048dc17072faff8fd90201ee80344bea5000d610

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe
Size

37KB
MD5

2a920c23ffc5970a07d5eb9f90ee1d5d
SHA1

462e6c75d4757e5bf0ef2224b616f09487611ee2
SHA256

9de19940309743c988de7e8f445b0baffb1c8297696ccb1839ab6c2035fcc106
SHA512

a0a8795271f60e7190087f794900b9ae67a9e59d25bbbe1d510b7c387672131fab0f7fdf35b1d167f1595e0afe7f55260f1003e3a76baaf84e4c7dcac7d113bc
SSDEEP

768:EHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJqTQvDXACvV:EpgpHzb9dZVX9fHMvG0D3XJG8pV

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

Au_.exe

pid	Process
2376	Au_.exe

Executes dropped EXE 1 IoCs

Processes:

Au_.exe

pid	Process
2376	Au_.exe

Loads dropped DLL 4 IoCs

Processes:

uninst.exeAu_.exe

pid	Process
2120	uninst.exe
2376	Au_.exe
2376	Au_.exe
2376	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

uninst.exeAu_.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
behavioral17/files/0x000500000001a4c3-2.dat	nsis_installer_1
behavioral17/files/0x000500000001a4c3-2.dat	nsis_installer_2

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Au_.exe

description	pid	Process
Token: SeRestorePrivilege	2376	Au_.exe
Token: SeBackupPrivilege	2376	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

uninst.exe

description	pid	Process	procid_target
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30
PID 2120 wrote to memory of 2376	2120	uninst.exe	30

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
37KB

MD5
2a920c23ffc5970a07d5eb9f90ee1d5d

SHA1
462e6c75d4757e5bf0ef2224b616f09487611ee2

SHA256
9de19940309743c988de7e8f445b0baffb1c8297696ccb1839ab6c2035fcc106

SHA512
a0a8795271f60e7190087f794900b9ae67a9e59d25bbbe1d510b7c387672131fab0f7fdf35b1d167f1595e0afe7f55260f1003e3a76baaf84e4c7dcac7d113bc

Download Submit