Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 11:40

General

  • Target

    Uninstall.exe

  • Size

    75KB

  • MD5

    f7eb4bc689e6cf7d36040dbe0d9331e5

  • SHA1

    19bca2dd29fb9f54822bd2cacb68bf85063cf92a

  • SHA256

    c8f0bd7f368607af6abaeaacc7b37a43ea0c807bf2bbc8e9d5a73cfe06c72fe7

  • SHA512

    062c699df55ed81e1f0f77452bf7816fff9ebfb95885cb3ee132cf17d727c258b9a3c9d8983f8370227996e25f42d526f821950465df35bcda4ce0f8d6f6d023

  • SSDEEP

    1536:DPx/CJAmx2/W5Ebnto4tmJK+ekp6jV++VIY2Znip6zv0:rx6UW6tpmJKS4ZxX2Zip6A

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
        "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" DelArcadeFromFireWallExceptions
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2704
      • C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
        "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" convertShortcutsToLinks
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2852
      • C:\Users\Admin\AppData\Local\Temp\iWinTrusted.exe
        "C:\Users\Admin\AppData\Local\Temp\iWinTrusted.exe" -remove
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2684
      • C:\Users\Admin\AppData\Local\Temp\WebInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\WebInstaller.exe" -uninstall
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s /u "C:\Users\Admin\AppData\Local\Temp\iWinGamesHookIE.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2848
      • C:\Users\Admin\AppData\Local\Temp\iWinGames.exe
        "C:\Users\Admin\AppData\Local\Temp\iWinGames.exe" /trackArcadeUninstall_reason_0
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe
        "C:\Users\Admin\AppData\Local\Temp\AdminWorker.exe" uninstallDesktopAlerts
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2540
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinGamesHookIE.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2620
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinInfo.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2284

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\iWinGames\Downloads\cache.dat

          Filesize

          160B

          MD5

          7bcfdf4ff2fd7e9f38e4e836ce443378

          SHA1

          aee14127fd409c3de064e5bb65ed057dca3cb4f7

          SHA256

          428deca3f08767b4091b1839cd2d84dc827d569e244f8a3cec2817ffbef46a71

          SHA512

          8c883692d453708b02e087330630f6d1f14f9a282cc905211a836071e4c095b819ccaac0fac951b74e13f116ab575ed9c78ea58de04915639db2c915b028bf32

        • C:\Users\Admin\AppData\Local\Temp\iWinGames\iWinGames.log

          Filesize

          406B

          MD5

          e661e214e2e3a4b34534087af7a157c8

          SHA1

          9d9da4838515c6e65bd0300baefbdae80a3b58e2

          SHA256

          97c0d116d0ea2783b20b8bd29464f13bd6cb3c4f1e6c85b946089db5316e6bcc

          SHA512

          210aabddb0fbbc86037863cb552fa55608f20cedf2ae40408bc2ade58e127b1975e0e198668434f9ebbfab5102403e2e862549cd86f9dc3d9f48045717bf6943

        • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          75KB

          MD5

          f7eb4bc689e6cf7d36040dbe0d9331e5

          SHA1

          19bca2dd29fb9f54822bd2cacb68bf85063cf92a

          SHA256

          c8f0bd7f368607af6abaeaacc7b37a43ea0c807bf2bbc8e9d5a73cfe06c72fe7

          SHA512

          062c699df55ed81e1f0f77452bf7816fff9ebfb95885cb3ee132cf17d727c258b9a3c9d8983f8370227996e25f42d526f821950465df35bcda4ce0f8d6f6d023

        • memory/2540-28-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2540-30-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2640-27-0x0000000002B80000-0x0000000002BB9000-memory.dmp

          Filesize

          228KB

        • memory/2640-14-0x0000000002B80000-0x0000000002BB3000-memory.dmp

          Filesize

          204KB

        • memory/2640-17-0x0000000005360000-0x0000000005F2D000-memory.dmp

          Filesize

          11.8MB

        • memory/2640-9-0x0000000002B80000-0x0000000002BB9000-memory.dmp

          Filesize

          228KB

        • memory/2684-16-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/2704-12-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2704-11-0x0000000000230000-0x0000000000232000-memory.dmp

          Filesize

          8KB

        • memory/2704-10-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2740-18-0x0000000000400000-0x0000000000FCD000-memory.dmp

          Filesize

          11.8MB

        • memory/2740-26-0x0000000000400000-0x0000000000FCD000-memory.dmp

          Filesize

          11.8MB

        • memory/2852-13-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB