fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
Size

251KB
MD5

8db7695fe1d149afe23a4186bbc7262a
SHA1

f0bcd19630bd58cdbb96f48bdecda7c023162417
SHA256

fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d
SHA512

afb9c14137f52879cd6a3252ae27cdede137bd28fb7208150553c50490ddb314d652ababb5d3637a057cd22837f848da7cc57f96f96089d2f878fa29bf825686
SSDEEP

6144:5eVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:y7+AitXqsTkiR7twRx+gD8PJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1768	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2752	Logo1_.exe
1952	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
File created	C:\Windows\Logo1_.exe	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe
2752	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1768	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	28
PID 1180 wrote to memory of 1768	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	28
PID 1180 wrote to memory of 1768	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	28
PID 1180 wrote to memory of 1768	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	28
PID 1180 wrote to memory of 2752	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	29
PID 1180 wrote to memory of 2752	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	29
PID 1180 wrote to memory of 2752	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	29
PID 1180 wrote to memory of 2752	1180	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	29
PID 2752 wrote to memory of 2768	2752	Logo1_.exe	31
PID 2752 wrote to memory of 2768	2752	Logo1_.exe	31
PID 2752 wrote to memory of 2768	2752	Logo1_.exe	31
PID 2752 wrote to memory of 2768	2752	Logo1_.exe	31
PID 2768 wrote to memory of 2672	2768	net.exe	33
PID 2768 wrote to memory of 2672	2768	net.exe	33
PID 2768 wrote to memory of 2672	2768	net.exe	33
PID 2768 wrote to memory of 2672	2768	net.exe	33
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 1768 wrote to memory of 1952	1768	cmd.exe	34
PID 2752 wrote to memory of 1188	2752	Logo1_.exe	10
PID 2752 wrote to memory of 1188	2752	Logo1_.exe	10

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
  "C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8372.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
      "C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe"
      4⤵
      Executes dropped EXE
      PID:1952
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8372.bat

Filesize
722B

MD5
2a9e0fcaaa46bd541a6a12f9ef72a50e

SHA1
fde2b15fe701f657e1484a8f7350f60125772edf

SHA256
3c00b31819519b47f3560e18aba07ac3cf6b15e7cbea57e415d1a9dfb56d8766

SHA512
637812689b366add94fdf7d4dafe8516b7cbf071e92cb465e1a00ed62ac9ab4520c6254705ce873447fda49fa551d6088477dd734e9f2da83dd41740569430e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe.exe

Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
eb37f2c68f47fb3f74c28159989bd100

SHA1
ddd654c1ed158fd0264510a138c4f225729eb8df

SHA256
a1520309aad7314231726286edafdba2f7b1ce1af32869c2b59d4026954d7bb8

SHA512
074885ff5bf127085be45bd266ccf0400c6f32cf7d302f7cec1e11a58a04cc9134c16ba88f771d7535b4e86ccffd77bfc9e947de1bb0921b85d7aa66bb235143

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\_desktop.ini

Filesize
9B

MD5
b347a774e254ac3f0d6aaea35544ac50

SHA1
7f332d15a7648f7a698b3068a428811361f4e9ab

SHA256
1ebd1b85bb264260df3d9fb0a2062b29199c7b6137dcc98486874c1d257c73cd

SHA512
ce8615c90c8794f0aefeb0c6ce5da126732695e6be36b5e625f3a073d55c6f8cd88ca465b07e2c0e87355b5baad887a3f0b26c4eb262484a83d35565e72ba138

Download Submit
memory/1180-16-0x00000000001B0000-0x00000000001E4000-memory.dmp

Filesize
208KB

Download
memory/1180-40-0x00000000001B0000-0x00000000001E4000-memory.dmp

Filesize
208KB

Download
memory/1180-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-18-0x00000000001B0000-0x00000000001E4000-memory.dmp

Filesize
208KB

Download
memory/1188-30-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/2752-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-46-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-1851-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-3311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download