Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe
Resource
win10v2004-20231020-en
General
-
Target
205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe
-
Size
2.0MB
-
MD5
2ceb9127d57039a9f0c716150d1a8655
-
SHA1
4412359ec325ff8b6888317453506aad5861b6e0
-
SHA256
205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf
-
SHA512
57e3c020b7c6e81e8895a6479d3205ddd008a82caf1c86aac8e2343a3121fbe9a5067114649ace7d1d0362c509fd9a9a8fb96db4ffd2e068fa180ba007d7e853
-
SSDEEP
49152:d0TW6eM7W0ScPydbhGGLkd1TeidrS10gdN7gIrP7CtEykL5:WHeM7zScP2bhGEYrdnIqxo
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4280 Logo1_.exe 2216 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft.NET\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe File created C:\Windows\Logo1_.exe 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe 4280 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1980 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 86 PID 4580 wrote to memory of 1980 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 86 PID 4580 wrote to memory of 1980 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 86 PID 4580 wrote to memory of 4280 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 87 PID 4580 wrote to memory of 4280 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 87 PID 4580 wrote to memory of 4280 4580 205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe 87 PID 4280 wrote to memory of 4576 4280 Logo1_.exe 89 PID 4280 wrote to memory of 4576 4280 Logo1_.exe 89 PID 4280 wrote to memory of 4576 4280 Logo1_.exe 89 PID 4576 wrote to memory of 4660 4576 net.exe 91 PID 4576 wrote to memory of 4660 4576 net.exe 91 PID 4576 wrote to memory of 4660 4576 net.exe 91 PID 1980 wrote to memory of 2216 1980 cmd.exe 92 PID 1980 wrote to memory of 2216 1980 cmd.exe 92 PID 1980 wrote to memory of 2216 1980 cmd.exe 92 PID 4280 wrote to memory of 3376 4280 Logo1_.exe 45 PID 4280 wrote to memory of 3376 4280 Logo1_.exe 45
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe"C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a854D.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe"C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe"4⤵
- Executes dropped EXE
PID:2216
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4660
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD516d53298149f0b043d8bf4fc2e5c221c
SHA1f02ed855266962faf090c0000271a6140b056585
SHA256d502cb88273648d7b22eb0c01753662b5354e3909ad31c5c5a3e8d7c379d6367
SHA512546c568f28aac3c25b2eec81e7bc9562e1a2d1c733164165b91710f3ceda9dfa6d5636d097eb81aa272f36fd45aecd390192534b1ccca52bdc7e9ad094de9b41
-
Filesize
484KB
MD54886cdd27042c51d5b4e6f2d64f0ee95
SHA18079cf9e6b03cdd23bd529d0b29851c00cfda740
SHA2562271e9e21d4db15eecd8d92cfa7c1b19709335ac642cf3b3547efa5659c2aa1d
SHA51210bc0665d8dfabaa1986c95989f56d35743d587ea03051a0bf0160ee3d2ab7bd7309c51758ef1f3250ab57756439cc75ab80633119bab1fcbfe57e9c0116c4d5
-
Filesize
722B
MD599f0744b83ef93bd6c7d6434946d9f56
SHA11fbf41eb852403697bcc1cd8c85a4e365a58ce82
SHA25652ad0ae86cb76f5a84421a74543c3a6ee353e5e79c4c2d93b0074bc1ab6deca8
SHA512e135fc9a46a45f0581327367700c947efebe1fea7c5366f8c28d80ea4dd1b665e0fb734e38e66d245dae88bca8067df5c515649a183a9766f2adbb4f4ff663da
-
C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe
Filesize1.9MB
MD5ddcaa8742bd6d3c80e52517866e3778b
SHA195c35c3be7131e89676946d4bfc7ad92e46d9d07
SHA25663ed4675ef51c8917b9b5223d043dfda60643c6a7f2771780790a2abbc140990
SHA512467d54c2d8361019f84eb1595ee4e480f8113093a1abbc0dc5da075cfa7b4033e8aa10368c52fc881fa1c162cb99a1058f020560315d4607d0f0316ab2292d99
-
C:\Users\Admin\AppData\Local\Temp\205da77afffb72db57453424281b05d995b425cbd9300a69745480a5ba881faf.exe.exe
Filesize1.9MB
MD5ddcaa8742bd6d3c80e52517866e3778b
SHA195c35c3be7131e89676946d4bfc7ad92e46d9d07
SHA25663ed4675ef51c8917b9b5223d043dfda60643c6a7f2771780790a2abbc140990
SHA512467d54c2d8361019f84eb1595ee4e480f8113093a1abbc0dc5da075cfa7b4033e8aa10368c52fc881fa1c162cb99a1058f020560315d4607d0f0316ab2292d99
-
Filesize
26KB
MD5a9dc4a172100eccd1c7ff84e66719574
SHA1c7ff20b4ee5562c514f504318a0f72f12b1d84d3
SHA2569e9d44f576105feeea2201d9809027bd049d3f38101dcd85b9dcd11b86a037d9
SHA512a3e5f460fc8bd397a277e1480e8863d9ec3245f5b7b18849c15289473db10e5f429e82c7a89e4323a637f9b570685f9677efcbeaad2d8a26f160a42967785284
-
Filesize
26KB
MD5a9dc4a172100eccd1c7ff84e66719574
SHA1c7ff20b4ee5562c514f504318a0f72f12b1d84d3
SHA2569e9d44f576105feeea2201d9809027bd049d3f38101dcd85b9dcd11b86a037d9
SHA512a3e5f460fc8bd397a277e1480e8863d9ec3245f5b7b18849c15289473db10e5f429e82c7a89e4323a637f9b570685f9677efcbeaad2d8a26f160a42967785284
-
Filesize
26KB
MD5a9dc4a172100eccd1c7ff84e66719574
SHA1c7ff20b4ee5562c514f504318a0f72f12b1d84d3
SHA2569e9d44f576105feeea2201d9809027bd049d3f38101dcd85b9dcd11b86a037d9
SHA512a3e5f460fc8bd397a277e1480e8863d9ec3245f5b7b18849c15289473db10e5f429e82c7a89e4323a637f9b570685f9677efcbeaad2d8a26f160a42967785284
-
Filesize
10B
MD57af371ae7aad351d505f1b26382de243
SHA10a19bf0a1ccfb902a03b3da68bdd289190e62f5f
SHA2564fcc643d52dbc25dd57a011e27cbb0503711cf1a2ad1610a4f9e7b9f17c5bc1b
SHA5121127b9c88de9e2d58f7a512dd52c31bb9d96b0543f13e4cfff59ca2b73e60307538dd9bcd1c480e6d260fe45b44208a5554a5a60e8c2e3da8385b2cdd0e77d3e