8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59

Analysis

max time kernel
190s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Size

56KB
MD5

1061d59747c43b312f76dafa35c83e30
SHA1

087156122d65dc49bf8eff5468c363a998a87b89
SHA256

8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59
SHA512

1df8001454ad3c830261a7a51ef69e73485931ca8824d7b8eaab66ccaa1c87d85615ae4d2793555ab6529ebd8e7be377b6a42f96f2a2e235b10c70a82a4aa580
SSDEEP

768:pO16GVRu1yK9fMnJG2V9dHS8FY1st5LxI1Q4AwdVGWq0CVacOI+EfAympPvbr:pI3SHuJV9Na1O+GWq0CccR+eenbr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4336	Logo1_.exe
3572	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\F:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
File created	C:\Windows\Logo1_.exe	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe
4336	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3936	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	83
PID 3432 wrote to memory of 3936	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	83
PID 3432 wrote to memory of 3936	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	83
PID 3432 wrote to memory of 4336	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	85
PID 3432 wrote to memory of 4336	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	85
PID 3432 wrote to memory of 4336	3432	8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe	85
PID 4336 wrote to memory of 3576	4336	Logo1_.exe	86
PID 4336 wrote to memory of 3576	4336	Logo1_.exe	86
PID 4336 wrote to memory of 3576	4336	Logo1_.exe	86
PID 3576 wrote to memory of 3948	3576	net.exe	88
PID 3576 wrote to memory of 3948	3576	net.exe	88
PID 3576 wrote to memory of 3948	3576	net.exe	88
PID 3936 wrote to memory of 3572	3936	cmd.exe	89
PID 3936 wrote to memory of 3572	3936	cmd.exe	89
PID 3936 wrote to memory of 3572	3936	cmd.exe	89
PID 4336 wrote to memory of 1192	4336	Logo1_.exe	34
PID 4336 wrote to memory of 1192	4336	Logo1_.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
  "C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B22.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
      "C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"
      4⤵
      Executes dropped EXE
      PID:3572
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a4B22.bat

Filesize
722B

MD5
74c06769d20d78c9e28a27f4bd197e20

SHA1
98d1f937ad99b94d8e84fff9e125a750d6ae2065

SHA256
1b68d6a98e10d5ce2aec5cd4405fbe8616a6e35efb985bc80fc1bbcc0e1d2462

SHA512
ca7e36c33f61a975970646fb5eca6d474ddfc6a32e1fd30faffbf6f7b5fcb5bc8063ea82c854106ccf42e75be996637640ef553ce39d9efaaa98070925551532

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe

Filesize
26KB

MD5
d45503f138788a2fbff13aa4b0dac123

SHA1
980166d3ef51cae11933cb398312686272dd8a18

SHA256
280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72

SHA512
2287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe.exe

Filesize
26KB

MD5
d45503f138788a2fbff13aa4b0dac123

SHA1
980166d3ef51cae11933cb398312686272dd8a18

SHA256
280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72

SHA512
2287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
77705d80528f0563515f76450582bfa4

SHA1
ce91c845049cbe7980acd5047956c84dbe2f58fe

SHA256
04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

SHA512
67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
77705d80528f0563515f76450582bfa4

SHA1
ce91c845049cbe7980acd5047956c84dbe2f58fe

SHA256
04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

SHA512
67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
77705d80528f0563515f76450582bfa4

SHA1
ce91c845049cbe7980acd5047956c84dbe2f58fe

SHA256
04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

SHA512
67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

Download Submit
memory/3432-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3432-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4336-145-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4336-146-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download