30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431

Analysis

max time kernel
152s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe
Size

180KB
MD5

408c1bb0e6b776782fce5d05bafcf211
SHA1

17cda0da8f37a1964b1cedf35b667d3ca322696e
SHA256

30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431
SHA512

9fbfecbba73f03b325d4142758948c2e98c317acae61733451ca3ebed641bf55e2fc679c3560617f3092cfbc5f0372e475555fe552a5122eea325827e639b1f0
SSDEEP

3072:YftffjmNJLdTx0HPNncumAEib3S9nHCFlIRI90+mI:oVfjmNJLdTx0aumYbC9nHC0I904

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4396	Logo1_.exe
1924	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MutableBackup\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\he-IL\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe
File created	C:\Windows\Logo1_.exe	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe
4396	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 5068	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	81
PID 1308 wrote to memory of 5068	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	81
PID 1308 wrote to memory of 5068	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	81
PID 1308 wrote to memory of 4396	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	82
PID 1308 wrote to memory of 4396	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	82
PID 1308 wrote to memory of 4396	1308	30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe	82
PID 4396 wrote to memory of 4284	4396	Logo1_.exe	84
PID 4396 wrote to memory of 4284	4396	Logo1_.exe	84
PID 4396 wrote to memory of 4284	4396	Logo1_.exe	84
PID 5068 wrote to memory of 1924	5068	cmd.exe	86
PID 5068 wrote to memory of 1924	5068	cmd.exe	86
PID 5068 wrote to memory of 1924	5068	cmd.exe	86
PID 4284 wrote to memory of 2268	4284	net.exe	87
PID 4284 wrote to memory of 2268	4284	net.exe	87
PID 4284 wrote to memory of 2268	4284	net.exe	87
PID 4396 wrote to memory of 760	4396	Logo1_.exe	59
PID 4396 wrote to memory of 760	4396	Logo1_.exe	59

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe
  "C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D21.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe
      "C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe"
      4⤵
      Executes dropped EXE
      PID:1924
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a6D21.bat

Filesize
722B

MD5
1452591acb8ec58fa7040452633f4f73

SHA1
5726ee8014d13f74a5c941ca76594d12bebc5db8

SHA256
45040ef0e91d932c360f791682a40962261e4610744c74cd9cddffae19fbff50

SHA512
b0a29123751b3994b590443fa0f11cb545995bdcf525de4f9bdba22b2a4ea0b10c7aca0001b605011e078fa6e1981b94d4122e50059f2e7495e3ad0539cfa855

Download Submit
C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe

Filesize
153KB

MD5
3919077672fdde6058cec5bccad5c481

SHA1
f2e39315b68517f8aa6349242176ca45b4ed1eec

SHA256
08dea5bfa8c6e9e8e1b41390c538c8b66827f68351d5d800859563dc00daba8a

SHA512
5b39b67e123267c7d7b37317c7937ba62dc59e4870763bbffe28ebb11c071d5797b6032e856908aac17854542c14a6f78b0cc96b7fe22634f868caae58f93a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\30921dec1452e8beba23059ffde675e5a509f3dc902c4a594e062b46ed9e0431.exe.exe

Filesize
153KB

MD5
3919077672fdde6058cec5bccad5c481

SHA1
f2e39315b68517f8aa6349242176ca45b4ed1eec

SHA256
08dea5bfa8c6e9e8e1b41390c538c8b66827f68351d5d800859563dc00daba8a

SHA512
5b39b67e123267c7d7b37317c7937ba62dc59e4870763bbffe28ebb11c071d5797b6032e856908aac17854542c14a6f78b0cc96b7fe22634f868caae58f93a56

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
73f465dafb1a342f4a789f78f8deb652

SHA1
87bb6209cdc09c1914f6562b2d45129e92cb69b8

SHA256
b712dfdc35f88006476bec926c14f3b085b8f2d38762a8977d62e4bc40eeac59

SHA512
5198754e4b83d7025dbb0d3338a1fe4472333bf89f105af4485e76406c16d7887acaca67020ab140093eab86537999f8a3ff325b34830967605074b7c925e3f2

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
73f465dafb1a342f4a789f78f8deb652

SHA1
87bb6209cdc09c1914f6562b2d45129e92cb69b8

SHA256
b712dfdc35f88006476bec926c14f3b085b8f2d38762a8977d62e4bc40eeac59

SHA512
5198754e4b83d7025dbb0d3338a1fe4472333bf89f105af4485e76406c16d7887acaca67020ab140093eab86537999f8a3ff325b34830967605074b7c925e3f2

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
73f465dafb1a342f4a789f78f8deb652

SHA1
87bb6209cdc09c1914f6562b2d45129e92cb69b8

SHA256
b712dfdc35f88006476bec926c14f3b085b8f2d38762a8977d62e4bc40eeac59

SHA512
5198754e4b83d7025dbb0d3338a1fe4472333bf89f105af4485e76406c16d7887acaca67020ab140093eab86537999f8a3ff325b34830967605074b7c925e3f2

Download Submit
memory/1308-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1308-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-142-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download