4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
Size

136KB
MD5

594820c6b6c441f81483c3f1e32ae651
SHA1

1d44150440bb38772dc2b4e774091050744ebf0c
SHA256

4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf
SHA512

0117d8992693761f267cd608c860d28a26df202c3fe1bfea0bb16446c6eda2a0664931b652f808024a43df6d28925b2db5cc1316f81fd192d88176f96b4abcf1
SSDEEP

3072:+ftffjmNiWI9HZmwZ2blRN2CIRjKtYOUz:mVfjmNoDT2b7N+bv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2932	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2596	Logo1_.exe
2416	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe

Loads dropped DLL 4 IoCs

pid	Process
2932	cmd.exe
2416	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
2416	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
2416	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
File created	C:\Windows\Logo1_.exe	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe
2596	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2932	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	28
PID 2268 wrote to memory of 2932	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	28
PID 2268 wrote to memory of 2932	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	28
PID 2268 wrote to memory of 2932	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	28
PID 2268 wrote to memory of 2596	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	29
PID 2268 wrote to memory of 2596	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	29
PID 2268 wrote to memory of 2596	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	29
PID 2268 wrote to memory of 2596	2268	4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe	29
PID 2596 wrote to memory of 2548	2596	Logo1_.exe	30
PID 2596 wrote to memory of 2548	2596	Logo1_.exe	30
PID 2596 wrote to memory of 2548	2596	Logo1_.exe	30
PID 2596 wrote to memory of 2548	2596	Logo1_.exe	30
PID 2548 wrote to memory of 2552	2548	net.exe	33
PID 2548 wrote to memory of 2552	2548	net.exe	33
PID 2548 wrote to memory of 2552	2548	net.exe	33
PID 2548 wrote to memory of 2552	2548	net.exe	33
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2932 wrote to memory of 2416	2932	cmd.exe	34
PID 2596 wrote to memory of 1200	2596	Logo1_.exe	21
PID 2596 wrote to memory of 1200	2596	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
  "C:\Users\Admin\AppData\Local\Temp\4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8B7D.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe
      "C:\Users\Admin\AppData\Local\Temp\4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2416
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
b78b69c1eee165faf82ad3ee2f997bd2

SHA1
ddc5dbc59bf9dbdda7674091477721683f937cb4

SHA256
279bfec670ba55620ff2d83b371258373803208d232aa6d31deada4af762b324

SHA512
f472264c3fe25095a2c21902d4944b22ada3e472ea1ee7a73987d9076d08efb1c287b6db64ff6e4156955df2a4bd2171f16cb0c732b459d94b6a314cbfef13e4

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8B7D.bat

Filesize
722B

MD5
4e2314bbcc3218639d6203ebeeb46c0a

SHA1
63f28a8537407af9822daeadd36c736af2470a40

SHA256
c527309d314483e5bff2898ccee853d7469dc24d34e8e450d7e90b758cd55c30

SHA512
72473c54b6063a6e992043fd16e780b3bd81c44272c02897187225e8dde3c7dd0dbfcc145a11f2ee91c77f468f54b58ff409b959393f8ab2a2d86f3a41036851

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a3c6545b2c0b6ce7a82ae2d11510fd3e1f1819024704c40098cad0d457887cf.exe.exe

Filesize
109KB

MD5
3f8c60e433e546fde8a697decaa707ed

SHA1
5b96e55f8c3a40f6cd16c40117e4e152f256f022

SHA256
4fc300a5660c07924dc799d14e079f3d97dbf117f5cbdb6f5e9c27164dabb755

SHA512
3f168793f31f77588e3c10b91bd1d5537b4e2fddb9e4f44a05cacc9eb2e8b62c7f8dc3ab2597e1d837bdf42be311cba09ff36dd4c2b878e32aef4183bbabff5f

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
425fb6140a884a906b15042fcbd35c15

SHA1
e332088ea17dc0ed61313a76ff5f89dd8864b860

SHA256
7585359cf9a5803c71940e9841a1e4e5dcff7856a84a0037915597d37e3cfc0c

SHA512
fb27cf8658ee1fd863db753dbc107cbabff2e684168c833ab84e88585827edd5f7f3ee83ceaeafd7a93e343fa6522e9424898b2065e247be23b493da086873dd

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
a7058e06d084fd947f7dddc2897ebb22

SHA1
400bcc9cc3cbab99b910b4696cc0163ba8713226

SHA256
da0976fbb0588170763cb9b0d9b3ce23b0ff3e7cc146ecf1840a40e7655f1287

SHA512
4921df984df8d792e9cde40d30fd19e315b2af1b034966c6fc397ef92e3cb25cfa258400758277e9ec01b5609f3041ba42c8e5911b79eff5a08843a91ad9c9c9

Download Submit
memory/1200-32-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/2268-20-0x0000000000220000-0x0000000000254000-memory.dmp

Filesize
208KB

Download
memory/2268-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2268-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-1854-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-43-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-3314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download