Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89e77fbc40fbec8634e14735b73e1e8b.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
89e77fbc40fbec8634e14735b73e1e8b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
89e77fbc40fbec8634e14735b73e1e8b.exe
-
Size
83KB
-
MD5
89e77fbc40fbec8634e14735b73e1e8b
-
SHA1
833244644c24a547a9ffbd97f03f95d55596545d
-
SHA256
13d6b68b492666ff031247eb3643f299c530455b5547e31b5d4525ede113038d
-
SHA512
75d000ef3f07872e7953617f1951a92e0436291a4521581518b7538be2465b582dc530ae8c28c059d864495aacaab462f8ef46a72d6ca1c89c3493d0b57fa120
-
SSDEEP
1536:hy+53F5HIbVSo2Zm7c660mowS/Ia20GCwkeX7OvHLDUujVT:4+5V5oYo2E7h6bBSQaLwkeXSPbVT
Score
9/10
Malware Config
Signatures
-
Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 89e77fbc40fbec8634e14735b73e1e8b.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2356 Logo1_.exe 4224 89e77fbc40fbec8634e14735b73e1e8b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 89e77fbc40fbec8634e14735b73e1e8b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 89e77fbc40fbec8634e14735b73e1e8b.exe File created C:\Windows\Logo1_.exe 89e77fbc40fbec8634e14735b73e1e8b.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe 2356 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1868 wrote to memory of 540 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 85 PID 1868 wrote to memory of 540 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 85 PID 1868 wrote to memory of 540 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 85 PID 540 wrote to memory of 2384 540 net.exe 86 PID 540 wrote to memory of 2384 540 net.exe 86 PID 540 wrote to memory of 2384 540 net.exe 86 PID 1868 wrote to memory of 4656 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 87 PID 1868 wrote to memory of 4656 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 87 PID 1868 wrote to memory of 4656 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 87 PID 1868 wrote to memory of 2356 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 89 PID 1868 wrote to memory of 2356 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 89 PID 1868 wrote to memory of 2356 1868 89e77fbc40fbec8634e14735b73e1e8b.exe 89 PID 4656 wrote to memory of 4224 4656 cmd.exe 90 PID 4656 wrote to memory of 4224 4656 cmd.exe 90 PID 4656 wrote to memory of 4224 4656 cmd.exe 90 PID 2356 wrote to memory of 4316 2356 Logo1_.exe 91 PID 2356 wrote to memory of 4316 2356 Logo1_.exe 91 PID 2356 wrote to memory of 4316 2356 Logo1_.exe 91 PID 4316 wrote to memory of 3160 4316 net.exe 93 PID 4316 wrote to memory of 3160 4316 net.exe 93 PID 4316 wrote to memory of 3160 4316 net.exe 93 PID 2356 wrote to memory of 2776 2356 Logo1_.exe 94 PID 2356 wrote to memory of 2776 2356 Logo1_.exe 94 PID 2356 wrote to memory of 2776 2356 Logo1_.exe 94 PID 2776 wrote to memory of 4312 2776 net.exe 96 PID 2776 wrote to memory of 4312 2776 net.exe 96 PID 2776 wrote to memory of 4312 2776 net.exe 96 PID 2356 wrote to memory of 3392 2356 Logo1_.exe 27 PID 2356 wrote to memory of 3392 2356 Logo1_.exe 27
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe"C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E20.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe"C:\Users\Admin\AppData\Local\Temp\89e77fbc40fbec8634e14735b73e1e8b.exe"4⤵
- Executes dropped EXE
PID:4224
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3160
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4312
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
530B
MD54be388172844dfc31d2a93128e23c629
SHA11cdd7f45738049be3a19b0c1a46f1b406b78197e
SHA2566938948c2923c02a98015f43d6738e8d7e470c0a7fb3c8307f66e91d82f8a887
SHA512d7182e94f937ec4062c64635ed290b31a81a98e2f6e6bad879a101c1e90ec6523210bddb5d5c6b95175075b4922ce1468660690f992a56bfb7864dccd6e51053
-
Filesize
25KB
MD5c8c5c606e079c7243d2eb6548265b07a
SHA1ef558f7b7b6a6b0ad35974981673b6da7b63bb91
SHA25681c5476c22df9cfd35b62aab5f4f66e5fcafc0433a0b96192af8e0a304102af1
SHA512e30936a1e2de671d29c8b1cf65ad8297d657debc478f3b9ee21c66914c7a53eb65426064036c3edd2af4c722519db5894b78c629248612d42a3121a9b1fa3d88
-
Filesize
58KB
MD56b9949f677c1e6d2d130b866c0a928f6
SHA141ac679bacca058b8d8ff786cd049b9080357ff7
SHA256aebcc2eb391e36ef85d868be6293ff5c6d5b5c65b9e370fe21c8ed779165256c
SHA512f8fb960011e45dbf236bd482ef03823d5ecce9ab2748ae5314305ff8bc19b61d7bd9f656304c6ac1a506b139fe2f34207eac930e0ac074ca32a8fbe1ae360def
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47