5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184

General

Target

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
Size

1.1MB
MD5

4def29bc70afa4bdceeaefbab4329d30
SHA1

b7c093f4124bc4150dec407d57efb6fcfafafa7f
SHA256

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184
SHA512

70487e99d495b036f1760ed224bd61b877d0ff2d05aa8206fc0a2c19c3dfa7b3a57e8d420acd708ad636f657aabcf9c4b8971298474b01d534d71550dd2ea905
SSDEEP

12288:G5qOPajQUXXP8QvLWFx6Mo5rippDC7ee1hpls4Ey+g:G5najQEPnvg6PhWDC750g

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

pid process

4540 Logo1_.exe
5052 5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

pid	process
4540	Logo1_.exe
5052	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\loc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	Logo1_.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
File created	C:\Windows\Logo1_.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 5052 WerFault.exe 5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
Runs net.exe

pid	pid_target	process	target process
1268	5052	WerFault.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exeLogo1_.exe

pid	process
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe
4540	Logo1_.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

pid	process
5052	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
5052	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
5052	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
5052	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exenet.exeLogo1_.exenet.execmd.exenet.exe

description	pid	process	target process
PID 4408 wrote to memory of 4636	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	net.exe
PID 4408 wrote to memory of 4636	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	net.exe
PID 4408 wrote to memory of 4636	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	net.exe
PID 4636 wrote to memory of 4952	4636	net.exe	net1.exe
PID 4636 wrote to memory of 4952	4636	net.exe	net1.exe
PID 4636 wrote to memory of 4952	4636	net.exe	net1.exe
PID 4408 wrote to memory of 3496	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	cmd.exe
PID 4408 wrote to memory of 3496	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	cmd.exe
PID 4408 wrote to memory of 3496	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	cmd.exe
PID 4408 wrote to memory of 4540	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	Logo1_.exe
PID 4408 wrote to memory of 4540	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	Logo1_.exe
PID 4408 wrote to memory of 4540	4408	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe	Logo1_.exe
PID 4540 wrote to memory of 4984	4540	Logo1_.exe	net.exe
PID 4540 wrote to memory of 4984	4540	Logo1_.exe	net.exe
PID 4540 wrote to memory of 4984	4540	Logo1_.exe	net.exe
PID 4984 wrote to memory of 4728	4984	net.exe	net1.exe
PID 4984 wrote to memory of 4728	4984	net.exe	net1.exe
PID 4984 wrote to memory of 4728	4984	net.exe	net1.exe
PID 3496 wrote to memory of 5052	3496	cmd.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
PID 3496 wrote to memory of 5052	3496	cmd.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
PID 3496 wrote to memory of 5052	3496	cmd.exe	5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
PID 4540 wrote to memory of 776	4540	Logo1_.exe	net.exe
PID 4540 wrote to memory of 776	4540	Logo1_.exe	net.exe
PID 4540 wrote to memory of 776	4540	Logo1_.exe	net.exe
PID 776 wrote to memory of 2972	776	net.exe	net1.exe
PID 776 wrote to memory of 2972	776	net.exe	net1.exe
PID 776 wrote to memory of 2972	776	net.exe	net1.exe
PID 4540 wrote to memory of 2628	4540	Logo1_.exe	Explorer.EXE
PID 4540 wrote to memory of 2628	4540	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2628
- C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
  "C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4805.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe
      "C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1336
        5⤵
        Program crash
        
        PID:1268
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:4728
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5052 -ip 5052
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a4805.bat

Filesize
722B

MD5
12cebe6c7d42c729b2bffb501b5422fa

SHA1
2a00b5cb42298bcaf85fb883905ba70193c6ef0e

SHA256
96a082660d8b5ea91dd459b6e2b7972b9789c0e8564bb6925182db953bc9210c

SHA512
a885bc0bff6137a87868f061328282e404640bf39c842ed9a6d480e25769a1762228cbea7db16c0d8d2da5587f6f80734958ee6406c4ed356ce0fe3511ee3183

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe

Filesize
1.1MB

MD5
b0375fadbb808beaf33971aa2b1b56e2

SHA1
2b978167e0b264e7dd3484c61df8b31799f6867f

SHA256
92efe448504a68a44bdcdccad6c903580900a32977ef65b9af229f972551df33

SHA512
8e75fbda817d0c57e1206dbc689a0f2e2fc84f6af5774e0679c8b6088691b48e0399135b3ca9f530ded10a54ba84078f9b39060c54595b5ddd910b959a4f9d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eba89aae797ba61a4fa1e2d34b99fc8c640cc28d037d84f4a75d7f2dabc9184.exe.exe

Filesize
1.1MB

MD5
b0375fadbb808beaf33971aa2b1b56e2

SHA1
2b978167e0b264e7dd3484c61df8b31799f6867f

SHA256
92efe448504a68a44bdcdccad6c903580900a32977ef65b9af229f972551df33

SHA512
8e75fbda817d0c57e1206dbc689a0f2e2fc84f6af5774e0679c8b6088691b48e0399135b3ca9f530ded10a54ba84078f9b39060c54595b5ddd910b959a4f9d58

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
51ee7bb63f7a43951ed5c8b18abf1bd1

SHA1
8365dfbaaf7f0f81e7e8c8376a6e337b496606db

SHA256
dca933f59704702be0dd2630baa2d69981484282da2a9e3840a8dc2651d3a83f

SHA512
9da7783d9a07cb667cc41c80355d88cde975520ab38bf12ca1c4cf1348986b2d7b729a4ac5906b88c359469d82cef2d44916bd7553d1738fd509dfac1464cf2a

Download Submit
C:\Windows\Logo1_.exe

Filesize
33KB

MD5
51ee7bb63f7a43951ed5c8b18abf1bd1

SHA1
8365dfbaaf7f0f81e7e8c8376a6e337b496606db

SHA256
dca933f59704702be0dd2630baa2d69981484282da2a9e3840a8dc2651d3a83f

SHA512
9da7783d9a07cb667cc41c80355d88cde975520ab38bf12ca1c4cf1348986b2d7b729a4ac5906b88c359469d82cef2d44916bd7553d1738fd509dfac1464cf2a

Download Submit
C:\Windows\rundl132.exe

Filesize
33KB

MD5
51ee7bb63f7a43951ed5c8b18abf1bd1

SHA1
8365dfbaaf7f0f81e7e8c8376a6e337b496606db

SHA256
dca933f59704702be0dd2630baa2d69981484282da2a9e3840a8dc2651d3a83f

SHA512
9da7783d9a07cb667cc41c80355d88cde975520ab38bf12ca1c4cf1348986b2d7b729a4ac5906b88c359469d82cef2d44916bd7553d1738fd509dfac1464cf2a

Download Submit
memory/776-148-0x0000000000000000-mapping.dmp

Download
memory/2972-149-0x0000000000000000-mapping.dmp

Download
memory/3496-135-0x0000000000000000-mapping.dmp

Download
memory/4408-140-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4408-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-146-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-137-0x0000000000000000-mapping.dmp

Download
memory/4540-150-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4636-133-0x0000000000000000-mapping.dmp

Download
memory/4728-143-0x0000000000000000-mapping.dmp

Download
memory/4952-134-0x0000000000000000-mapping.dmp

Download
memory/4984-141-0x0000000000000000-mapping.dmp

Download
memory/5052-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads