Analysis
-
max time kernel
39s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f033bd451fd4a88fdccbb8bae4c9c13.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f033bd451fd4a88fdccbb8bae4c9c13.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
5f033bd451fd4a88fdccbb8bae4c9c13.exe
-
Size
639KB
-
MD5
5f033bd451fd4a88fdccbb8bae4c9c13
-
SHA1
d83b60019d7dbcec3022a40ab0147353035ab5f9
-
SHA256
c1b8cd1ccad4e1fd63dbb78474adab12877720fa018ed0406e7446f43503b4e6
-
SHA512
712359a8e5dad5fcee4ce9e5f315f52bbc8d732730bffc8b43d35493418ab7f09ab93a90db1844986e9c0fc9ec684f123b6ea732a4907433486d80d8096598b9
-
SSDEEP
12288:lhKt7ElgJFltxIwYQWP5DKwpoAH2q0hVM9cdQ5H/W4oqI:DK9ElgJFrx2VKw+AH2q0hVM9BfWuI
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 5f033bd451fd4a88fdccbb8bae4c9c13.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Deletes itself 1 IoCs
pid Process 2748 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2588 Logo1_.exe 2704 5f033bd451fd4a88fdccbb8bae4c9c13.exe -
Loads dropped DLL 4 IoCs
pid Process 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2588 Logo1_.exe 2748 cmd.exe 2748 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 5f033bd451fd4a88fdccbb8bae4c9c13.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File created C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\7zFM.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.Exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 5f033bd451fd4a88fdccbb8bae4c9c13.exe File created C:\Windows\Logo1_.exe 5f033bd451fd4a88fdccbb8bae4c9c13.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe 2588 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2936 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 26 PID 2968 wrote to memory of 2936 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 26 PID 2968 wrote to memory of 2936 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 26 PID 2968 wrote to memory of 2936 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 26 PID 2968 wrote to memory of 2192 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 23 PID 2968 wrote to memory of 2192 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 23 PID 2968 wrote to memory of 2192 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 23 PID 2968 wrote to memory of 2192 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 23 PID 2192 wrote to memory of 2992 2192 net.exe 24 PID 2192 wrote to memory of 2992 2192 net.exe 24 PID 2192 wrote to memory of 2992 2192 net.exe 24 PID 2192 wrote to memory of 2992 2192 net.exe 24 PID 2968 wrote to memory of 2748 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 41 PID 2968 wrote to memory of 2748 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 41 PID 2968 wrote to memory of 2748 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 41 PID 2968 wrote to memory of 2748 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 41 PID 2968 wrote to memory of 2588 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 39 PID 2968 wrote to memory of 2588 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 39 PID 2968 wrote to memory of 2588 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 39 PID 2968 wrote to memory of 2588 2968 5f033bd451fd4a88fdccbb8bae4c9c13.exe 39 PID 2588 wrote to memory of 2596 2588 Logo1_.exe 35 PID 2588 wrote to memory of 2596 2588 Logo1_.exe 35 PID 2588 wrote to memory of 2596 2588 Logo1_.exe 35 PID 2588 wrote to memory of 2596 2588 Logo1_.exe 35 PID 2748 wrote to memory of 2704 2748 cmd.exe 34 PID 2748 wrote to memory of 2704 2748 cmd.exe 34 PID 2748 wrote to memory of 2704 2748 cmd.exe 34 PID 2748 wrote to memory of 2704 2748 cmd.exe 34 PID 2596 wrote to memory of 2732 2596 net.exe 32 PID 2596 wrote to memory of 2732 2596 net.exe 32 PID 2596 wrote to memory of 2732 2596 net.exe 32 PID 2596 wrote to memory of 2732 2596 net.exe 32 PID 2588 wrote to memory of 2600 2588 Logo1_.exe 38 PID 2588 wrote to memory of 2600 2588 Logo1_.exe 38 PID 2588 wrote to memory of 2600 2588 Logo1_.exe 38 PID 2588 wrote to memory of 2600 2588 Logo1_.exe 38 PID 2600 wrote to memory of 2464 2600 net.exe 36 PID 2600 wrote to memory of 2464 2600 net.exe 36 PID 2600 wrote to memory of 2464 2600 net.exe 36 PID 2600 wrote to memory of 2464 2600 net.exe 36 PID 2588 wrote to memory of 2936 2588 Logo1_.exe 26 PID 2588 wrote to memory of 2936 2588 Logo1_.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f033bd451fd4a88fdccbb8bae4c9c13.exe"C:\Users\Admin\AppData\Local\Temp\5f033bd451fd4a88fdccbb8bae4c9c13.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵PID:2992
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2936
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a13FE.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"1⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5f033bd451fd4a88fdccbb8bae4c9c13.exe"C:\Users\Admin\AppData\Local\Temp\5f033bd451fd4a88fdccbb8bae4c9c13.exe"1⤵
- Executes dropped EXE
PID:2704
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"1⤵
- Suspicious use of WriteProcessMemory
PID:2596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"1⤵PID:2464
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"1⤵
- Suspicious use of WriteProcessMemory
PID:2600