fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
Size

251KB
MD5

8db7695fe1d149afe23a4186bbc7262a
SHA1

f0bcd19630bd58cdbb96f48bdecda7c023162417
SHA256

fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d
SHA512

afb9c14137f52879cd6a3252ae27cdede137bd28fb7208150553c50490ddb314d652ababb5d3637a057cd22837f848da7cc57f96f96089d2f878fa29bf825686
SSDEEP

6144:5eVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:y7+AitXqsTkiR7twRx+gD8PJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
216	Logo1_.exe
3336	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\swidtag\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
File created	C:\Windows\Logo1_.exe	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe
216	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4596	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	84
PID 1760 wrote to memory of 4596	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	84
PID 1760 wrote to memory of 4596	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	84
PID 1760 wrote to memory of 216	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	86
PID 1760 wrote to memory of 216	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	86
PID 1760 wrote to memory of 216	1760	fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe	86
PID 4596 wrote to memory of 3336	4596	cmd.exe	89
PID 4596 wrote to memory of 3336	4596	cmd.exe	89
PID 4596 wrote to memory of 3336	4596	cmd.exe	89
PID 216 wrote to memory of 2296	216	Logo1_.exe	87
PID 216 wrote to memory of 2296	216	Logo1_.exe	87
PID 216 wrote to memory of 2296	216	Logo1_.exe	87
PID 2296 wrote to memory of 1868	2296	net.exe	90
PID 2296 wrote to memory of 1868	2296	net.exe	90
PID 2296 wrote to memory of 1868	2296	net.exe	90
PID 216 wrote to memory of 3576	216	Logo1_.exe	57
PID 216 wrote to memory of 3576	216	Logo1_.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3576
- C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
  "C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA5.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe
      "C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe"
      4⤵
      Executes dropped EXE
      PID:3336
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
f580e7a1b32b4991802ae092df26799d

SHA1
83081e2f883e7e1cf8ad08fcbb12991515242724

SHA256
a888490bf4189f1c28dd6887bd06f883a916ad7618b77d4595482b19909fd1b2

SHA512
7024e16171f912ee78a4200dac671c6aabaed0f88fe27c79d011da5dbe490d20b17eeee29f047102273c666c327b70459437157e52f16d4119dbc8b61307470b

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aBAA5.bat

Filesize
722B

MD5
0bcd5c9194f6e4232c6b1a67e2f0f5c8

SHA1
c926039017023636ecb618b80eee0572d810678b

SHA256
538c9c9bb7aed10ef25a92e20db368d068877a5d7cf15129f07c7123464f385a

SHA512
db70f916077ee75719971eed3e2b0a941f33574dd00dbadc67344fe3385698f4ecdcb3511c8b4e145bcaca2873f89ac19cc634c4e97f577a3209ae4c50d85596

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb699b9b9f06cfffa73b9452baebe1f8c2b6d9f7613b53a4fd582378ab4ac62d.exe.exe

Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
eb37f2c68f47fb3f74c28159989bd100

SHA1
ddd654c1ed158fd0264510a138c4f225729eb8df

SHA256
a1520309aad7314231726286edafdba2f7b1ce1af32869c2b59d4026954d7bb8

SHA512
074885ff5bf127085be45bd266ccf0400c6f32cf7d302f7cec1e11a58a04cc9134c16ba88f771d7535b4e86ccffd77bfc9e947de1bb0921b85d7aa66bb235143

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\_desktop.ini

Filesize
9B

MD5
b347a774e254ac3f0d6aaea35544ac50

SHA1
7f332d15a7648f7a698b3068a428811361f4e9ab

SHA256
1ebd1b85bb264260df3d9fb0a2062b29199c7b6137dcc98486874c1d257c73cd

SHA512
ce8615c90c8794f0aefeb0c6ce5da126732695e6be36b5e625f3a073d55c6f8cd88ca465b07e2c0e87355b5baad887a3f0b26c4eb262484a83d35565e72ba138

Download Submit
memory/216-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-37-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-899-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-1004-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-1167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download