df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a

Analysis

max time kernel
178s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe
Size

68KB
MD5

3652b87998946f9eaec771eae01f5384
SHA1

27251fbaa4df091f9c9401744e06adfb57a9c47d
SHA256

df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a
SHA512

14e122203982c8a21ee75208ce7b2930b1764b74aad1c94bc22c0980a20a6237280bf0111adbfe92bdee73de7e4dd1dafc9e631af5bc7fad0dd2c8f215c7e787
SSDEEP

1536:AfgLdQAQfcfymN71gNnR1PL9YoOIlg0FJf:AftffjmNpgrlfF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2188	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File created	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe
2188	Logo1_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1652	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	92
PID 4688 wrote to memory of 1652	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	92
PID 4688 wrote to memory of 1652	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	92
PID 4688 wrote to memory of 2188	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	94
PID 4688 wrote to memory of 2188	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	94
PID 4688 wrote to memory of 2188	4688	df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe	94
PID 2188 wrote to memory of 1316	2188	Logo1_.exe	96
PID 2188 wrote to memory of 1316	2188	Logo1_.exe	96
PID 2188 wrote to memory of 1316	2188	Logo1_.exe	96
PID 1316 wrote to memory of 1456	1316	net.exe	98
PID 1316 wrote to memory of 1456	1316	net.exe	98
PID 1316 wrote to memory of 1456	1316	net.exe	98
PID 2188 wrote to memory of 3364	2188	Logo1_.exe	56
PID 2188 wrote to memory of 3364	2188	Logo1_.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Temp\df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe
  "C:\Users\Admin\AppData\Local\Temp\df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F9.bat
    3⤵
    PID:1652
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
484KB

MD5
9cbede5c7169b1bd71ecfffbaaab59fe

SHA1
037c2e0b0d19428d483af7f34dd8e0d71d0f3f04

SHA256
e286579d02a22beb288806ea7006fc2f65b339f9fac6cb0412d031091cc27852

SHA512
5d3009ffedeb3339560a5188140977f46f56f89bc021db5916d6a9f02eb030e96da3acec2324a80ee9f95ba6d93818fa73293b8203272b1b2caa842868cba86d

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aB3F9.bat

Filesize
722B

MD5
e6486ee4098184bcbf818878a86a1327

SHA1
fc5a714b6aa8bfc3032f4eccd98b072dac7174c4

SHA256
4d512ab533cb5626be6c2922bceea569978df9716f82818f79b2ffc76f300d05

SHA512
3b92d2790b2d5ac48446152abcd645aaa7f5428842ce0a121bb135d8d5dc8492772ff7d8ad0b7f443998e44cbb08f66f95aeb607f4717a87678054d98b4e4364

Download Submit
C:\Users\Admin\AppData\Local\Temp\df9bf5e6ca8278fe3ddc6fc7b28b7add683b8b5ef1dfaaf6fc5ce90ba3b0f94a.exe.exe

Filesize
42KB

MD5
774057afbd4dccd6992989a593720e86

SHA1
633b8f0677043c18f9541c3cb9478f2eee3695d0

SHA256
a9d1c28a189b61f37375f0b29d38e4a82d394c77a1c84721e638e2526c35d4ff

SHA512
37fcd7fa6400f76647c5052c2a3b82316dc95f51befd3bac6eb555824d157766393ff3bafb3a6802ddb918ae4870081174e4fc70869ae180725755daca332df2

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
006fea33f14c9da590dc8739811ffce2

SHA1
ad2319b507e25457427483b5d5a83f1f41aa19cc

SHA256
c24589d3af6a0fc94d9861e4e893d109cdbb2129051a178280fdd17a3e62af45

SHA512
f6117e3d55da2f84ac78babef6bc09df8955e37d73bfa351eb3e055c06f4f7aacc270a219bf28e0ec5d8c0b30c013d401bbd35dde42497501125490648156cca

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
006fea33f14c9da590dc8739811ffce2

SHA1
ad2319b507e25457427483b5d5a83f1f41aa19cc

SHA256
c24589d3af6a0fc94d9861e4e893d109cdbb2129051a178280fdd17a3e62af45

SHA512
f6117e3d55da2f84ac78babef6bc09df8955e37d73bfa351eb3e055c06f4f7aacc270a219bf28e0ec5d8c0b30c013d401bbd35dde42497501125490648156cca

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
006fea33f14c9da590dc8739811ffce2

SHA1
ad2319b507e25457427483b5d5a83f1f41aa19cc

SHA256
c24589d3af6a0fc94d9861e4e893d109cdbb2129051a178280fdd17a3e62af45

SHA512
f6117e3d55da2f84ac78babef6bc09df8955e37d73bfa351eb3e055c06f4f7aacc270a219bf28e0ec5d8c0b30c013d401bbd35dde42497501125490648156cca

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3125601242-331447593-1512828465-1000\_desktop.ini

Filesize
9B

MD5
4d72cff1ce9d97416bd764af363f34df

SHA1
e5377631a8a8ae98182121d4e15e878bd302dbc6

SHA256
023ab9831a0de101117d7d810372142f03ab43630ab99c68cbff7f11af67f861

SHA512
7489eb7b688a2ebd105c8f23c66ff71cb9f72546e4be795a888a12432d8b3ce50ca9dd173d9291ada405596864224e658af61479c70b2a7443161a533abce1e2

Download Submit
memory/2188-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-43-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4688-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4688-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4688-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4688-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download