fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4

Analysis

max time kernel
151s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
Size

154KB
MD5

6911e976059aace6b4c686d4c7f6c480
SHA1

1763f56620469fa4ac981a7d72a5b09f3ea8e3d0
SHA256

fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4
SHA512

904c5f8b8f359befaf57c0c6bd25947b126923ce022dfb0046c8b3d1712f96a74e5b2d03a6cbbe48c4fe4f5be2e9a39ec97a3a112131664ff1fc0440d97aff4d
SSDEEP

3072:pwkuJVLIaDcmjfamFQ1GJaRrzjq3DeZ+jThFkY:ruJ9cm1FQ1G8RrzmX+Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1700	Logo1_.exe
984	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe

Deletes itself 1 IoCs

pid	Process
1812	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1812	cmd.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
File created	C:\Windows\Logo1_.exe	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe
1700	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	26
PID 364 wrote to memory of 1812	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	26
PID 364 wrote to memory of 1812	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	26
PID 364 wrote to memory of 1812	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	26
PID 364 wrote to memory of 1700	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	28
PID 364 wrote to memory of 1700	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	28
PID 364 wrote to memory of 1700	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	28
PID 364 wrote to memory of 1700	364	fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe	28
PID 1812 wrote to memory of 984	1812	cmd.exe	30
PID 1812 wrote to memory of 984	1812	cmd.exe	30
PID 1812 wrote to memory of 984	1812	cmd.exe	30
PID 1812 wrote to memory of 984	1812	cmd.exe	30
PID 1700 wrote to memory of 1944	1700	Logo1_.exe	29
PID 1700 wrote to memory of 1944	1700	Logo1_.exe	29
PID 1700 wrote to memory of 1944	1700	Logo1_.exe	29
PID 1700 wrote to memory of 1944	1700	Logo1_.exe	29
PID 1944 wrote to memory of 1936	1944	net.exe	32
PID 1944 wrote to memory of 1936	1944	net.exe	32
PID 1944 wrote to memory of 1936	1944	net.exe	32
PID 1944 wrote to memory of 1936	1944	net.exe	32
PID 1700 wrote to memory of 1356	1700	Logo1_.exe	13
PID 1700 wrote to memory of 1356	1700	Logo1_.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1356
- C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
  "C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a7003.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe
      "C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe"
      4⤵
      Executes dropped EXE
      PID:984
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a7003.bat

Filesize
722B

MD5
3a4e26e892ed10d3d75a3f29fe2c6157

SHA1
20ab35a3ffc6c7c8bd2bb2a8c741b974ba581cd4

SHA256
130c09371cdfa3921a26bac4669fd16a35f1929a4f79a336635831ddf4a75cb1

SHA512
bf59d42d469127b916f870a21b3f8accd717fa9ab701bb6778fa569789963bc59b7d2df11fd3577b244de515df1b61596bc51061774f5cae96606f57e049c112

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe

Filesize
124KB

MD5
e4d04d2074ee74c56c1e5b1b316ab026

SHA1
3cf6d88c3b3605e9e8fed5cb101c551c65aa9555

SHA256
0b025849ba2d45240a2fa0f41eed7a84e356bab87b6b2ae0bb34c583b8c1bcb4

SHA512
dc53937812646c7164726d872799a2e2ff7fbcbdaa3547aa928d51ebe95eed78cd310bbeacc7b7d924556375cf158694a1c59ee2fc2b4adaaad92e911e29a7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe.exe

Filesize
124KB

MD5
e4d04d2074ee74c56c1e5b1b316ab026

SHA1
3cf6d88c3b3605e9e8fed5cb101c551c65aa9555

SHA256
0b025849ba2d45240a2fa0f41eed7a84e356bab87b6b2ae0bb34c583b8c1bcb4

SHA512
dc53937812646c7164726d872799a2e2ff7fbcbdaa3547aa928d51ebe95eed78cd310bbeacc7b7d924556375cf158694a1c59ee2fc2b4adaaad92e911e29a7a6

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
3781429b8c1180e7bd7ed54714d12fa9

SHA1
0d6058a654eebe0cf921c34061427612d69dc0b1

SHA256
9ae25ace8978581345f1c0cbf25224e8e7f9ec4c1defaad0ddaef5c7ff628453

SHA512
438b6fe5e51a8e65c2dbb8edce7b62e45e0b0d9f75b4dfa1d1296b7e54f09170f8c65b30dff6164745fc0ca92eecf274ab4e761023adb7574fd50705d5f28ae9

Download Submit
\Users\Admin\AppData\Local\Temp\fe9c4f6833115c316369d8323973b19e637871cdcd62c5f36b92b1405ec450b4.exe

Filesize
124KB

MD5
e4d04d2074ee74c56c1e5b1b316ab026

SHA1
3cf6d88c3b3605e9e8fed5cb101c551c65aa9555

SHA256
0b025849ba2d45240a2fa0f41eed7a84e356bab87b6b2ae0bb34c583b8c1bcb4

SHA512
dc53937812646c7164726d872799a2e2ff7fbcbdaa3547aa928d51ebe95eed78cd310bbeacc7b7d924556375cf158694a1c59ee2fc2b4adaaad92e911e29a7a6

Download Submit
memory/364-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1700-67-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1700-68-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download