4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01

Analysis

max time kernel
182s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe
Size

562KB
MD5

d19d9969fff77acc5a5778db30a47161
SHA1

153cc2f2e1e8b5178f1de57fe588589c62fbf8dd
SHA256

4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01
SHA512

b1912cb7f9aca0ffd948089eb48693f14545272d3e9bcef1ec851234ccf95385704d68084b6f37e2055f754cbee484a889b652a2b50fc74a57199588334a74a4
SSDEEP

6144:59TuJEvj1UuBYWqkpUbmZDhuN7141r0HiUZSxcApGza:fTj1fYWqkp4mZ241AHBGcAMa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2584	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2720	Logo1_.exe
3004	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe

Loads dropped DLL 2 IoCs

pid	Process
2584	cmd.exe
2584	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\fonts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe
File created	C:\Windows\Logo1_.exe	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe
2720	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2584	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	29
PID 2844 wrote to memory of 2584	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	29
PID 2844 wrote to memory of 2584	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	29
PID 2844 wrote to memory of 2584	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	29
PID 2844 wrote to memory of 2720	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	31
PID 2844 wrote to memory of 2720	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	31
PID 2844 wrote to memory of 2720	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	31
PID 2844 wrote to memory of 2720	2844	4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe	31
PID 2720 wrote to memory of 2576	2720	Logo1_.exe	32
PID 2720 wrote to memory of 2576	2720	Logo1_.exe	32
PID 2720 wrote to memory of 2576	2720	Logo1_.exe	32
PID 2720 wrote to memory of 2576	2720	Logo1_.exe	32
PID 2584 wrote to memory of 3004	2584	cmd.exe	34
PID 2584 wrote to memory of 3004	2584	cmd.exe	34
PID 2584 wrote to memory of 3004	2584	cmd.exe	34
PID 2584 wrote to memory of 3004	2584	cmd.exe	34
PID 2576 wrote to memory of 1976	2576	net.exe	35
PID 2576 wrote to memory of 1976	2576	net.exe	35
PID 2576 wrote to memory of 1976	2576	net.exe	35
PID 2576 wrote to memory of 1976	2576	net.exe	35
PID 2720 wrote to memory of 1212	2720	Logo1_.exe	8
PID 2720 wrote to memory of 1212	2720	Logo1_.exe	8

C:\Users\Admin\AppData\Local\Temp\4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe
"C:\Users\Admin\AppData\Local\Temp\4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2424.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe
    "C:\Users\Admin\AppData\Local\Temp\4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe"
    3⤵
    - Executes dropped EXE
    PID:3004
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a2424.bat

Filesize
722B

MD5
9e928140e549ec618dd4aeb427b0210e

SHA1
d93532b1f4a32e9536b747573b483ad0e8068a13

SHA256
659b8f8885c4af254d01513926e25c4b17de8e9f729f5939fc10a0ec54447980

SHA512
d0250be6e7ab503790325269e733f5085f4a4b965fb0d093c43f32e973bf3e533bfd9496e2864c7c5c3c26b47994867f94d5e0e8e6735856d7e0dac66e477a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4acc8629d16cd0f0fe869b82e4ae6d519353e299afd4aaf602afef675d152d01.exe.exe

Filesize
533KB

MD5
500f306e161d29a49d47eb046633166f

SHA1
abad3db52ce0463237ca1785545541399075ade3

SHA256
b4d783e2f40e9b3a4da806762367f5e890d5ee8558361aea57b966bd2f891a63

SHA512
fd6fa6af86746866495b07e999cf280aba18c13d1c11ad53782c6515760f5d418ef4d683a3607f842320e853c8ff5e49ad17d7c60b863a910f7885ac8e9dd4ed

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
886eb3bf6157b45d4a041e1e32608c70

SHA1
f476a007366ac0349789b0e803ec46be523f457a

SHA256
a0e9eac517b54fe732db8bf9ceeb76c64a43e2e53bfd18b5a4ab0f8475f3873b

SHA512
6e978385b23d3054695eaf2209e92591a667ccbde747f69cb63ae28f2db3a362d136bf16afb41ceb8eb304161cc698853f9cb825a26cc683e9a693d07c190fca

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3308111660-3636268597-2291490419-1000\_desktop.ini

Filesize
10B

MD5
34c7bf8c1e8aa0e76a1cb36da6f3c07f

SHA1
93bff4db65fd067f94ca08ce2654a2675925b27d

SHA256
89ee7da24a1550d124e7ac206a8d49733f819c098eebf27b8c7f28e931a09f53

SHA512
ba8fa54ac2e6eafb524f14c7d286d9910afd808ec561c933af8b72a9cdb813e0e7777dc04a9dfdb6c985f27f123ac34a19782d6c0e734f8ab4e9860c9033139b

Download Submit
memory/1212-30-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/2720-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-46-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-102-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-107-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-1852-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2844-15-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2844-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2844-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download