7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9

Analysis

max time kernel
196s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe
Size

203KB
MD5

22367ee4b2c9954b7cd7e3415dcf894a
SHA1

9f09bfa8f50559baadf83366725cdeec93f93f00
SHA256

7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9
SHA512

1b4537a3a002010077d78be40faedf7b1fad5ba6234597a5043da68b1753c490d646e7b886ec8ea2066175672141a8f6a5867b8a54caae4de73d944873d692b5
SSDEEP

6144:pVfjmNt/zUPNXJnz1hfjnKgTAhduXIGp9Vxvb:/7+t/MXJnz1hfjnKg0uXIGLvb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2984	Logo1_.exe
1980	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-FR\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe
File created	C:\Windows\Logo1_.exe	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe
2984	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3808	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	90
PID 2020 wrote to memory of 3808	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	90
PID 2020 wrote to memory of 3808	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	90
PID 2020 wrote to memory of 2984	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	91
PID 2020 wrote to memory of 2984	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	91
PID 2020 wrote to memory of 2984	2020	7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe	91
PID 2984 wrote to memory of 2840	2984	Logo1_.exe	92
PID 2984 wrote to memory of 2840	2984	Logo1_.exe	92
PID 2984 wrote to memory of 2840	2984	Logo1_.exe	92
PID 2840 wrote to memory of 2192	2840	net.exe	94
PID 2840 wrote to memory of 2192	2840	net.exe	94
PID 2840 wrote to memory of 2192	2840	net.exe	94
PID 3808 wrote to memory of 1980	3808	cmd.exe	97
PID 3808 wrote to memory of 1980	3808	cmd.exe	97
PID 3808 wrote to memory of 1980	3808	cmd.exe	97
PID 2984 wrote to memory of 3384	2984	Logo1_.exe	55
PID 2984 wrote to memory of 3384	2984	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe
  "C:\Users\Admin\AppData\Local\Temp\7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a467A.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe
      "C:\Users\Admin\AppData\Local\Temp\7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe"
      4⤵
      Executes dropped EXE
      PID:1980
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
8c2aa1cfa64939f392a147d610f646f5

SHA1
65b4e3c055a55fb1aea138fb6e2a3aac4b7a400a

SHA256
0967b3a5367a33b33108808e5ab9089d7582b5b202f3467d04b2c18a1127aa63

SHA512
6e3d208f17d862d48c0a7d94dbe8f4e333a96b6db175e6e35367a1aed4cc1caa64a137cdebde011bd7732ad757e0846838e5d5911df9e63dd4d138f038512e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a467A.bat

Filesize
722B

MD5
125f642bd8e269a4f3f11dab76eed04d

SHA1
0e2f8394e02f68d4a0c14790db51775804aa143d

SHA256
8c3c0fdcd8168ac26f0743bb575593155019d78eab2aa807c04749acb15af4a1

SHA512
b7e38e26c74009cc30369c25db5f48120ff2d7f6e7d54bf051a8630ed0e4be64a22063633715a61823809839236a3ba3ec05a5ed027f4de1f2a29322043fd7ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ec9e2332a8da4f40d544c350ab0603e0833946bddcffd43caab19edaa3b6ce9.exe.exe

Filesize
176KB

MD5
35fdbc2ed8d67b594f71bfbbbd9d0211

SHA1
fa18f37bfeb2662ab8fd376408aae7eb0f001cdd

SHA256
b581b4039e0c030a1f7368ee247c3049d6487ead7a5eae10f05d05c6489185c5

SHA512
a99807bc1c2ace7db4fae560c1ed0e9c75541743369d75f09ed7b782a22e47fb5a909789c911df9418b8e0cb883fd1ac981fa63b63a8db0e3e4aa0241cb33919

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
9e0bc600a539724474d993ba6152bce2

SHA1
f5eb402e6aad061d3775e719455e2f96023a426a

SHA256
4b5c7d6d585dcdf378555aecad7ad0d4d609ae281d6bc628669478c13ed0b4e5

SHA512
f2a4a0325c54861556f006ea4843c9a8cda8c8f282e7f9e7dc9a3b60905d022e38f80121375ed5f0b00b451596fcf6c4baaad5f5e0ae3db8b6f2cc12c09001c4

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\_desktop.ini

Filesize
8B

MD5
eb3fe7085aac4986a5db69d6c382011f

SHA1
19c0d93bf576dc3bcf232628428d6218f91767a0

SHA256
41f6ad8112406e684ecf32a535c20fbac2db8d577e00b14197146b599a4b6ab2

SHA512
26ed6484407c76b27987c2ed0e5ec2522ea6053de299c486841195690c536d72d0569fb291a9b9a91ce74fa22f4c37c43b491f4d0ff00afb8771bd36a7dcf508

Download Submit
memory/2020-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-35-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-906-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download