Analysis

  • max time kernel
    92s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 20:59

General

  • Target

    LGS_9.04.49_x64_Logitech.exe

  • Size

    120.0MB

  • MD5

    87a1119a7108e33da161b24b6aa763ad

  • SHA1

    3f32007e62f174b411f0c69be9779a6321363153

  • SHA256

    6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0

  • SHA512

    69d5d7808dae0d84fe588850b1cc0f749debdfed6646191c51bdb67ad99d683c4507a38d2c65e05571bdffb32914b656fb74a1d37d1f09b05370fed0d26cba0d

  • SSDEEP

    3145728:NAhY0THiaUvrE7pisu8402Ujk45hAacfBQHHvh9l:NABksEj45hAacfunvh9

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LGS_9.04.49_x64_Logitech.exe
    "C:\Users\Admin\AppData\Local\Temp\LGS_9.04.49_x64_Logitech.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\Setup.exe expr=SetVar(level,"1")==SetVar(indent,"2")
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\MSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\MSetup.exe" expr=SetVar(level,"1")==SetVar(indent,"2")
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\1-LGS-x64\compcfg.ini

    Filesize

    590B

    MD5

    1e210469af26083b9c30852dcd8c2bdf

    SHA1

    5e56f537ad3c26971b925a3066a32595999a5655

    SHA256

    b5e41dfe8aba330fcdf3db493b6ffb9fe889f7eb1d0196e139345cd4a339821c

    SHA512

    54d047efa00948cb12158fba6b6c99138d9abae5b8a0db2121b48da3b374ea07f7db707113f6d3ff043e365fe81c867dd49fb46a99b762f41a2fe202d2428a05

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\1-LGS-x86\compcfg.ini

    Filesize

    590B

    MD5

    e66492db9c9f317af6bc05907765ae6e

    SHA1

    1138b1024f6a6e9bae2d5224041d3670c2f52893

    SHA256

    cc832367c57df6043c288524ac03d3249846256f27c7b3cd1207fea9a8abdf6e

    SHA512

    5d692bc415ee2ef1ef277755491547954d8dd158e4e391322efa457302ae64ed02e6759639b72bbe471a390005d3e18542352f29bc457996f94a40021540bda3

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\MSetup.exe

    Filesize

    1.6MB

    MD5

    018b7319bc52fce2fefe2324ef2dcb15

    SHA1

    1816b27b9edd7aabed4930fa5b2c3740603e348e

    SHA256

    9f677ba5f0d63c79ab3e0b3850d651433dab0f0f087073711d954a8e40d0aac5

    SHA512

    baebc5ce488a2cc27d70abd9bc6a5f2545e0b807456044d4355e89cbfc277ec3aa77b05a8b06001c16d980073d3da4512bb1efb9d16bb086d1b8cb1ff27e5447

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\Setup.exe

    Filesize

    294KB

    MD5

    2f08d63bd6a6b8ab242cf87c5fd310a0

    SHA1

    2373187db907db948705f4b78c280f1bc945ac40

    SHA256

    5d5ccf2a4184d5413ea4c00c64f03cfb3f0c9b8ccb9d308994088118c75497fc

    SHA512

    191437f8155cfebc465690f4763de5f4ade16fd9888683749eec6590fa4787a496895765e4ba1b4382c0d1169a7c67e34fccb8e8edc0a245e9042cf82f643460

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\SetupDll.dll

    Filesize

    62KB

    MD5

    6716f4e5ee82ffef2991b925dec0c760

    SHA1

    b933f9530d2ad848d212fc1e7c785b520b87eaca

    SHA256

    daca629f2fc1c97340f4fe77cf25677952e58a369cfa8953f9f11d599924ed6d

    SHA512

    6cacc14831a442508294ef363a44ea7bda6f3383ac9616fdf778af2edca582874c061bb4c4ace064f3920684cab9878742c88fdfff15bbc11f162264712174a2

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\lgs.ico

    Filesize

    85KB

    MD5

    fd919aeae1b80c98043d6f6217b1818a

    SHA1

    71c0cb2fb5b733f4bfa09f2175a3edfc7c224d4b

    SHA256

    30d4ace87d9b97ca2e77d1af7f3493fa1d42c0a2fb9ce12d77f0c04a746cca1b

    SHA512

    0550cd1c53226031148421abcd887ff667621ccfeabb0d12dd677d33c8d67ec8c43c9d86197be5b92b18c98235beabe962bfa050ab0de42300ea40f1fce4d787

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\setup.ini

    Filesize

    5KB

    MD5

    9d1d69694701e1b360484e5df9c5d915

    SHA1

    5696aa173bba489999d044daf1a023dfa5af45d8

    SHA256

    9920b2bd827e97a76410062ca607b6a654dad1f5b269ff3587157ffee4f45431

    SHA512

    71904680b3719857bd5fe487464138c7ab0a4baee6cedc3b2976b7204f5c9ba7d6f9dcfc6aecbc9eeaece9e505884f2d17730b6a694133fede3172047cfbcbef

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\ENU\CustomStrings.xml

    Filesize

    6KB

    MD5

    377d8d8f23fec61e527938e3e225cfbb

    SHA1

    2bee55d779b96bbee0639cef3c28a7f59ce703f9

    SHA256

    4ea72f78e855d7aca0e69b9757aa71991518ef1b48d9a88bb1bffa1a676d1143

    SHA512

    af5a6d54e7c53af6b4cbc57af59bc0a22a819f63fffc1c2c1f9541fd34938098d9e125ee4ba81d97c02c4ac1807cf19d8f2c7db6f3c5501266cefef86856abff

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\ENU\License.txt

    Filesize

    9KB

    MD5

    99ad60e744ed7bcf3b3f2b6c9e60ee3a

    SHA1

    f95aa2e6bc2c0966e14bc42b4b62e86f5751dde2

    SHA256

    8d56a49d9b3fa0fcddabfb073268633a39a84cefe0e25fd08b2df739ebb354b5

    SHA512

    04b881037038447b0b76116f3736922b4d21ae15f93750a6c3a43cc3e3e986e0b38a6f38aa00cb7a9e1c534e3f340e0770d904bb156f9b5f9f7c57bc60214ee0

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\ENU\StockStringsBase.xml

    Filesize

    14KB

    MD5

    062d6b96070bc2c1ed16eb60449247fb

    SHA1

    ff96f1b2efc587de3c3522b93eedb14147e8cb03

    SHA256

    7d0588c94a5efde2572f7b46500a4b0cfc5ead61950a8b35a48fe3584be5918c

    SHA512

    60b1ff57ef0ec2cb2bd7774c55453d68e2dfb521deef073eb762da60cb0f5b46eb88cd96f9e28824e64de89ae4db228e1ac4f7e51981fafad3f528da5087d4f3

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\ENU\StockStringsBranded.xml

    Filesize

    1KB

    MD5

    d2825927f9eb5d9b894cb923a27eb88e

    SHA1

    de34c1c3cbde4d2bf395969c062fadae7dd2ab24

    SHA256

    12782510ddda16605ae0daf3fe1678b4c218154999669954658c1d72e9efe2f6

    SHA512

    54b9f270fbddc770e38a372a969be041b74f7efb458141396ca18a289cba1e190473803ea323298540abbc5628cc11018c9ba02839e459f2b315fba0c5cdb783

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\StockLayout.xml

    Filesize

    4KB

    MD5

    aa90b05d71dfa3a3b0196ca1d45943a1

    SHA1

    3c595d9d2f82dd034efacbcb69917e2391450286

    SHA256

    0b7ba802683041273db33b0d9df7b9498adf3f14fdb8a86757a89e2b095a99c4

    SHA512

    8f9faa1c527d75da78ed4e39615ca586fe3de8494094c078f90e086997595e3e34373684b5fe9287557346221e75b08a9eb0dc5463e203e7a39ef7a17e6492d1

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\deu\wizpage.css

    Filesize

    15KB

    MD5

    581d93880badef39363971e4d23407c9

    SHA1

    b1adc0b8a6c1f84f8b304ce3a7d351570b5ad0ec

    SHA256

    ac1f708f484615863c193da4fdc880b25c93370cf8e59c904c1f131a2dbed1e6

    SHA512

    e9c0c077a8942737de8c3a4bf09dd06d06be0b25ccde636fda3c27200e173f18691016ae48d35525bff73db0e183d0713dd8357cb47a8c1412e1fbbb62011089

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\enu\CustomLayout.xml

    Filesize

    5KB

    MD5

    11316c82034a1df4689d300f57644bc5

    SHA1

    1646b14b2cd6ff5c5999967840fbbfa2133d9609

    SHA256

    240c1c06f2cb7fe73418c41af491c9805aadd31bea8727fcb819d18750659610

    SHA512

    fb76525e70d8173908e29c8636bab505968066730c08930140419ebdb5537ba089e876a0ce243e5f4e7c8cd72230a4b940dff95561d3d4fb4e5557f1b6d593aa

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\html\Install_1.html

    Filesize

    11KB

    MD5

    5386604170d65e9d6a20d9967ab55be9

    SHA1

    9982c9382498765fbf36ef6e1ceceb570fba3205

    SHA256

    08ade3b2f672b6f7afb71309108e2f5509b9a221dc81a5f4b9c320df3e9fc198

    SHA512

    9f3ac4afb998776eedc95735eae76b74f11aae70c7cbfe675d2c0afa5307fab799f154e8fbc02a64b6587bdbf1471afbd4b75252cab01b9b5e440ed3845da563

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\collateral\LogitechG_horz.png

    Filesize

    2KB

    MD5

    fd253b487d5467e93124c1fd6e6bc1ea

    SHA1

    159063246af47ee3617f6eaf534f5d5a6aa1b328

    SHA256

    454d983c0572b9400733c5fcf42b3ed62f5ef7c2e5abc0456dd647c49eade808

    SHA512

    bfdb6c680213a57a82645437bb8160f8684448228a10cecbf2caae1b1fd390ceb4ceadc2a367c84499de9b2ff64b45eec9f06e79c756ab17858196032d8e97ef

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\logos\logo_enu.png

    Filesize

    3KB

    MD5

    97433e6e67775884819f229cafe2b49f

    SHA1

    c46804d32d6673e07a97a1097c3c50afa5cc64fb

    SHA256

    0265ce533396c8d50832266b331a3ded4efdaf276c4ebe0f7699dea6c4c6ceb8

    SHA512

    b60abb5d526b1509d5405175f471aee808ead0bf521a3817d56d1b164e7fa78a16059e4f440ba09980d689d75d7611cabfc4fde16f2da1d1797c3232e7c7fca4

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\backgroundimage.png

    Filesize

    392B

    MD5

    cf3f24ab5372c1b9525e0f3e7aabc7f7

    SHA1

    ce7f3ca6423de05732b1af38505420f062bf3f5f

    SHA256

    932eb46e2c07673982f5ef7f386f9648855bc731216161ab49eb0aefb72ec223

    SHA512

    751312e2debb832ceb484ca3253a748368cd0553d99a1619bff6b6dcf6d1902e6f41ed72f6490a07414bd6b9c9306b76668e790ef5e3235d1f5b383dfc813a5a

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\btn_disabled.png

    Filesize

    440B

    MD5

    1fafcfd475242dbe0c3c02975eb368e9

    SHA1

    5b87047488adf9e37de8b2331a85583b7bf1ee0f

    SHA256

    2a84816f81f2a4112ea879a2c48158af00debcb498a3085208b40975d8ebaa6d

    SHA512

    7828121f1dc46b7bec45f967a27347749f3235ed50063f183e67d4719f6705e9173b2a140bcbe268bd03d37b87c95471e64d99fa55e77a20d05a98814e955c1e

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\btn_hover.png

    Filesize

    316B

    MD5

    8627f3ae1dbd215cad7fe6271e33b915

    SHA1

    e940299d5016b12a9040982786c44eef4cee4fb7

    SHA256

    5e966486e768f1d068c86123bd7373234d95b907fb443d3fe102849a44eb8172

    SHA512

    97dd78195579e4dc99e23459156291846830c684c904b10e95b368363460dc197806f4f7a216c4ade7ed39d256289ea2485275aa360db494ed7f7d7b328fdc98

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\btn_normal.png

    Filesize

    421B

    MD5

    6007af22c325f60872cc88c008c3817f

    SHA1

    bddee219e15346cd2d6a6dd13486d6b136a74271

    SHA256

    c5c70da634bc3ae9e845bfde1f5285f833a2de7ef59406d8aa1bb344d44aee93

    SHA512

    437fb784c06300779d6f4e70da769595fecfa9504ca214b46740816f38502f557f1c019a6d07d7ede858c975e5b9891f8c4aab0a6b8d8c2dfcc9047ee957323c

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\btn_pressed.png

    Filesize

    1KB

    MD5

    b2631f645a29bcf00180fcd867793a46

    SHA1

    307f141993af7fcfc7e17ace50073fc76460ba6e

    SHA256

    3c84849ef781e971e0f58bcbb4a8006b46a8f7f3f464e856c60516ab79f563dc

    SHA512

    7efa1e47ce7e0150a172120ec4b2d10d6749ec3eb54829e853f8e0ffc5669dcaf0bfc6e3e16bab459b5eb6b6e954461f7018c66d4ace40173e4ef8537fa65738

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\radio_active.ico

    Filesize

    1KB

    MD5

    26cc668f3f1519d63c38e66caa179bb9

    SHA1

    842819af31515a5e966eacdca8b75730dc0a6c69

    SHA256

    8951f8608791da9ca0de01b52222f94b671117e104ab79f5694a88d1c38b7dfd

    SHA512

    d41df90a24a0d570244a97a32b8670bf4ddaf4bcad8285771a5d32145d8864951e7c65860e5147825c1364aafd48f736d43fa9b30d81d38749c9e8695ad56a74

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\radio_complete.ico

    Filesize

    1KB

    MD5

    bfabafb791e8e93484693f0846d9693f

    SHA1

    8a3c3671023704e3260976a207a000866eb0bac0

    SHA256

    5756f1a2bae0b258cd43a25d4af3f00ff9cc8d11c51923b8c921e77b8e8caf5b

    SHA512

    436238b96eae1664d5f36feff482ae9a5bb1f11a259c03382843710281164ef13e6c043ac0e6b9335e87c9050b99af7119d1a0f458d36078dff3ef14f4a5c59e

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\radio_inactive.ico

    Filesize

    1KB

    MD5

    442db58664bccc14641e5ecce9a3c4a9

    SHA1

    902c3e410d8db26e75617063d1a201f59fef6880

    SHA256

    edd1101786acee3765e2c9224eb2bd01232b8a3ff2ecaf18329e9bbadf0b3de3

    SHA512

    723207eec6dc5c6e87498be93e6fe03141dc9d15bf6f241b99e8ff1db4db8d80a72d6586a74b35532a46289d6cd41edff1352da056f7c97417504587aa2d6716

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\images\standard\stepimage.png

    Filesize

    202B

    MD5

    15313ff9f7dff60b1cbc4b9b0b058850

    SHA1

    92915add9c0a3cfde62cb823a3f940d2b084997a

    SHA256

    156bc0edfa38ad1a72b50b55692a36b1180996b2cb7d58bcb5e9555c351684d3

    SHA512

    592f808b217e5d35295f698757bb4c9ac5548722a6a01413a3cabdab963093cd8dd352e188612caa04757ede6de7316551d90649d84ecd7e579c44d08ed3356c

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\js\custom_ui.js

    Filesize

    8KB

    MD5

    607e532d644cc83c5465ed7412877176

    SHA1

    075317c2250e356cf5681d1e158332f961b71e19

    SHA256

    3f2a502d4bc7f364f51970141a7e0a830b5b91b5b3e53766410f1f7c7f557eba

    SHA512

    0ec5a0ac8b8c17d208aed47a4b7eae6e04f144e1d1cbe6224eba296034cf393b942e9a8f87edd674ee908f4dd303827b97e146a1af02ce59eb887f6cae53bc01

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\js\logi_code.js

    Filesize

    10KB

    MD5

    e454d6bbe6a8b2ecd7ae07c38af329fa

    SHA1

    5fe9ea8947024ecd7d9755a38404aad4dfcbb25c

    SHA256

    49e97c8a18b92bd58891d4910f59fcf6e0d352e223ab8ba637158d02ebf52be5

    SHA512

    71a365ea1f733ce3cbb75e45fee748f491c88ae50af8391e15e4d8698b81b5e2e1d22f3f8541081f4734f49c21b9e7664325ed961c0a2f8192a010846cdd12ea

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\js\logi_uninstall.js

    Filesize

    4KB

    MD5

    1098d2d89d6799011e35b1fee35ce177

    SHA1

    8e71117f6e85d555221500fb8413fb31731e30be

    SHA256

    0de18a2f0fdf9d3edb547fd9adb569dca0b836012b6a3f6db005d37afb5c812a

    SHA512

    76968684052ca9c5c73b28e33ae86812af7da3c531e3102c62ccc3837675370048f96f03553e88cfa798dfe66b136f798f738ad36cce57586d36483bc6709e7e

  • C:\Users\Admin\AppData\Local\Temp\Logitech\Logitech_Gaming_Software_1\ui\resource_ids.txt

    Filesize

    13KB

    MD5

    0746f1e5678a9d66d4ce329f09722d8d

    SHA1

    886362ee7ce32a3cffb2a574240213088d0ff688

    SHA256

    34c59c533feed348f8a0610b4ada28891781d94304b56132c6314f4917c31ba3

    SHA512

    38f3e1b81e440a555b322d7cd9465130f715a5411aa7c868b8b52dfc66a934f02f6999584f54e5588345cf0fe1c9b102a5da2e60545f0341e2468013e6e10312

  • C:\Users\Admin\AppData\Local\Temp\nse69D8.tmp\System.dll

    Filesize

    11KB

    MD5

    0ff2d70cfdc8095ea99ca2dabbec3cd7

    SHA1

    10c51496d37cecd0e8a503a5a9bb2329d9b38116

    SHA256

    982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

    SHA512

    cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

  • C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

    Filesize

    601B

    MD5

    25581143522e9bd93ee11796a9408d90

    SHA1

    73328f8f487c5f664c3fbdf2a95692266a811054

    SHA256

    4bde4c1cc1040c2397785d8e3f97ccf9d5cab3ac3d3ec1779b5cc6c619445c21

    SHA512

    fc61808f4b984cc3d46a28a620227ef72fd11d75e347d7f5421f7ab101edb6df9aab7311e18615ea7256eee4f4f8ee2d7aa8aaa82459eff49d77f0ea1b977b4d

  • C:\Users\Admin\AppData\Roaming\Logishrd\LGS8_setup\LGS8_setup.log

    Filesize

    1KB

    MD5

    209919d4b27bcc1be3f12e809a51d78c

    SHA1

    f0946f440c2360635105d4fab94437790b167ee2

    SHA256

    6d1a8e001fcecea3de21d76a3447edbd5ef47859a258ad1bcd59757f8c7fdd87

    SHA512

    451a7e623d1ca801a631d7fa354e8eca529cbdb9ef272cf55c5096a3abfcdf5150c2b322e236bd9ca86d298255ff144a5d4682cf2bc3a49e556111a656a70f2f