e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a

Analysis

max time kernel
150s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe
Size

575KB
MD5

424a3d376fef29b33eb0db07ab1b420a
SHA1

9bc87cc0596eaf218fdd1086fd2cd78e37449f32
SHA256

e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a
SHA512

8ab47253a52d606bafd19a9535245c8769a650093c0520b694ccbd615e4990893eab7939fbdf2dc309dd05753a3255a1a8b0774ba616a8b7b026f4c4881f6c9d
SSDEEP

6144:PVfjmNJbxaxzLu0Xz5WM7z6VVbwbyiKs/HPQhoYewxmQSENzC8Kwgb8:97+J41hz6VVMb0O8c8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1204	Logo1_.exe
916	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe

Deletes itself 1 IoCs

pid	Process
1356	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1356	cmd.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe
File created	C:\Windows\Logo1_.exe	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe
1204	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1356	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	27
PID 1308 wrote to memory of 1356	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	27
PID 1308 wrote to memory of 1356	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	27
PID 1308 wrote to memory of 1356	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	27
PID 1308 wrote to memory of 1204	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	29
PID 1308 wrote to memory of 1204	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	29
PID 1308 wrote to memory of 1204	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	29
PID 1308 wrote to memory of 1204	1308	e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe	29
PID 1204 wrote to memory of 556	1204	Logo1_.exe	30
PID 1204 wrote to memory of 556	1204	Logo1_.exe	30
PID 1204 wrote to memory of 556	1204	Logo1_.exe	30
PID 1204 wrote to memory of 556	1204	Logo1_.exe	30
PID 1356 wrote to memory of 916	1356	cmd.exe	31
PID 1356 wrote to memory of 916	1356	cmd.exe	31
PID 1356 wrote to memory of 916	1356	cmd.exe	31
PID 1356 wrote to memory of 916	1356	cmd.exe	31
PID 556 wrote to memory of 1764	556	net.exe	33
PID 556 wrote to memory of 1764	556	net.exe	33
PID 556 wrote to memory of 1764	556	net.exe	33
PID 556 wrote to memory of 1764	556	net.exe	33
PID 1204 wrote to memory of 1212	1204	Logo1_.exe	9
PID 1204 wrote to memory of 1212	1204	Logo1_.exe	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe
  "C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a6B6.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe
      "C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe"
      4⤵
      Executes dropped EXE
      PID:916
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:556
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a6B6.bat

Filesize
721B

MD5
a14e16c6e5dd751ec304de92ef40cd5b

SHA1
42e95de858d9f145a358cc9da47f5e67a77ba3b8

SHA256
d4a27825ef378fd4f38f0e89f3985229e5e9c952360ab72f0518ae9c81c9a98d

SHA512
59fd68c63eafd09342ea27aa000c37906cf424709bfbe0d995ba04e244529d77fc820d102bb3e8ddb25eea861460271924d4be609544d9dfc15ed50f59bcc44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe

Filesize
549KB

MD5
3f60ff27fa222e95795f6a15514f6af9

SHA1
fe89d4dd69fe3b0bb824928f4c93be0c3c951dd0

SHA256
ff48f7e1b80e7d20d8daa44a6f4d6acc248e6c65bec0d0f81ff7e8961b3dd4de

SHA512
ed25c588300bd9a6fcbf5ff4e48710a571d0637cb2c2cf599708bffab4cac1e8ad997b4214bcdc31dbcadbf3da12d13571feab3af2d8a72b6370a18b4aa7a3bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe.exe

Filesize
549KB

MD5
3f60ff27fa222e95795f6a15514f6af9

SHA1
fe89d4dd69fe3b0bb824928f4c93be0c3c951dd0

SHA256
ff48f7e1b80e7d20d8daa44a6f4d6acc248e6c65bec0d0f81ff7e8961b3dd4de

SHA512
ed25c588300bd9a6fcbf5ff4e48710a571d0637cb2c2cf599708bffab4cac1e8ad997b4214bcdc31dbcadbf3da12d13571feab3af2d8a72b6370a18b4aa7a3bf

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c6492befa5393b1a32402e84331b39ff

SHA1
c0958e4984463d37d236c5d4f2bad8bea5deeb96

SHA256
3cc6397951b24e26f6239d575174708ff1e13eb29492ee1de79ed3bb4c1d0030

SHA512
52c11947409c435e28f62ddb08124a4e027db0bf89460c3d2d569c7958fece03bbda9750f5a79a066c2dba7ecca4692eb09a340ebc893e58234a1bf1018de2a0

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
c6492befa5393b1a32402e84331b39ff

SHA1
c0958e4984463d37d236c5d4f2bad8bea5deeb96

SHA256
3cc6397951b24e26f6239d575174708ff1e13eb29492ee1de79ed3bb4c1d0030

SHA512
52c11947409c435e28f62ddb08124a4e027db0bf89460c3d2d569c7958fece03bbda9750f5a79a066c2dba7ecca4692eb09a340ebc893e58234a1bf1018de2a0

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
c6492befa5393b1a32402e84331b39ff

SHA1
c0958e4984463d37d236c5d4f2bad8bea5deeb96

SHA256
3cc6397951b24e26f6239d575174708ff1e13eb29492ee1de79ed3bb4c1d0030

SHA512
52c11947409c435e28f62ddb08124a4e027db0bf89460c3d2d569c7958fece03bbda9750f5a79a066c2dba7ecca4692eb09a340ebc893e58234a1bf1018de2a0

Download Submit
\Users\Admin\AppData\Local\Temp\e8972788991eda9e3d2145eca63c4a1082adb3db8a45f40aa46fc13f6834961a.exe

Filesize
549KB

MD5
3f60ff27fa222e95795f6a15514f6af9

SHA1
fe89d4dd69fe3b0bb824928f4c93be0c3c951dd0

SHA256
ff48f7e1b80e7d20d8daa44a6f4d6acc248e6c65bec0d0f81ff7e8961b3dd4de

SHA512
ed25c588300bd9a6fcbf5ff4e48710a571d0637cb2c2cf599708bffab4cac1e8ad997b4214bcdc31dbcadbf3da12d13571feab3af2d8a72b6370a18b4aa7a3bf

Download Submit
memory/916-66-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1204-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1204-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1308-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download