Analysis
-
max time kernel
100s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe
-
Size
26KB
-
MD5
c4ee499db531da9678ef39e03ab686b6
-
SHA1
189b612ab93c2ff8c51daba95764ccc59bcc3a7f
-
SHA256
97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b
-
SHA512
48c7d71f9155b2acebaf2e2f7f21141c72c3a6c3fcfd76e89c7a22201ee0f6268c2639e86ac2f04cca01199d6f3760c4ede7a9451667b39e6f23fbd06b2b379c
-
SSDEEP
768:h01ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLC:YfgLdQAQfcfymNu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2080 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe 2080 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3648 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 17 PID 1752 wrote to memory of 3648 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 17 PID 1752 wrote to memory of 3648 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 17 PID 1752 wrote to memory of 2080 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 25 PID 1752 wrote to memory of 2080 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 25 PID 1752 wrote to memory of 2080 1752 97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe 25 PID 2080 wrote to memory of 2008 2080 Logo1_.exe 23 PID 2080 wrote to memory of 2008 2080 Logo1_.exe 23 PID 2080 wrote to memory of 2008 2080 Logo1_.exe 23 PID 2008 wrote to memory of 796 2008 net.exe 18 PID 2008 wrote to memory of 796 2008 net.exe 18 PID 2008 wrote to memory of 796 2008 net.exe 18 PID 2080 wrote to memory of 3436 2080 Logo1_.exe 59 PID 2080 wrote to memory of 3436 2080 Logo1_.exe 59
Processes
-
C:\Users\Admin\AppData\Local\Temp\97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe"C:\Users\Admin\AppData\Local\Temp\97999c42e803e4af578e083940e95cb032e14233bf84d8aa54c2f45a3f98c84b.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5870.bat2⤵PID:3648
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"1⤵PID:796
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"1⤵
- Suspicious use of WriteProcessMemory
PID:2008
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436