f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe
Size

252KB
MD5

3055d511163bd665e36aa71cf424ff2c
SHA1

100d3231f9f0833ce242b1160ab36eff8aaba9c0
SHA256

f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a
SHA512

39ab63863f2a748c68165f47714c8333182c5ee92bb7fae99cc1d07f0011387dda582509e38b4d079ce8e622d1f0efee168d0e8181c9ff65234142fae4ac5b94
SSDEEP

6144:BFpOgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:bplitXqsTkiR7twRx+gD8PJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2128	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1376	Logo1_.exe
2032	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe

Loads dropped DLL 1 IoCs

pid	Process
2128	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VGX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe
File created	C:\Windows\Logo1_.exe	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe
1376	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2128	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	28
PID 2292 wrote to memory of 2128	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	28
PID 2292 wrote to memory of 2128	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	28
PID 2292 wrote to memory of 2128	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	28
PID 2292 wrote to memory of 1376	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	29
PID 2292 wrote to memory of 1376	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	29
PID 2292 wrote to memory of 1376	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	29
PID 2292 wrote to memory of 1376	2292	f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe	29
PID 1376 wrote to memory of 2600	1376	Logo1_.exe	30
PID 1376 wrote to memory of 2600	1376	Logo1_.exe	30
PID 1376 wrote to memory of 2600	1376	Logo1_.exe	30
PID 1376 wrote to memory of 2600	1376	Logo1_.exe	30
PID 2600 wrote to memory of 2692	2600	net.exe	33
PID 2600 wrote to memory of 2692	2600	net.exe	33
PID 2600 wrote to memory of 2692	2600	net.exe	33
PID 2600 wrote to memory of 2692	2600	net.exe	33
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 2128 wrote to memory of 2032	2128	cmd.exe	34
PID 1376 wrote to memory of 1160	1376	Logo1_.exe	20
PID 1376 wrote to memory of 1160	1376	Logo1_.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe
  "C:\Users\Admin\AppData\Local\Temp\f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1796.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe
      "C:\Users\Admin\AppData\Local\Temp\f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe"
      4⤵
      Executes dropped EXE
      PID:2032
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
472KB

MD5
88eb1bca8c399bc3f46e99cdde2f047e

SHA1
55fafbceb011e1af2edced978686a90971bd95f2

SHA256
42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

SHA512
149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a1796.bat

Filesize
722B

MD5
51bd8feee910a66d2b23749b2a2cd1a3

SHA1
629770200cba3c4207538ade1f1e97bee4ed822f

SHA256
be008ed3739b79cb31657b9821d300f232b75d1981a02a6577ba6857241565f8

SHA512
d2a9d03db8ad725d1840fbcd7b38b4aed55266dea54182534cb136c150703f0099c8ad9d80c6c6cfead53c6c65de30052ee2305a62b905ec75a82ecf637c2e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\f937ab7db604e62a78e5f2d7c1ecc536df075dc3e4876dc369185149421bcb1a.exe.exe

Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\rundl132.exe

Filesize
27KB

MD5
3848bdda6fa12d57631d2d9cfc0372cd

SHA1
7ad82878104b87dbb4af2236b49c27026fedcfe1

SHA256
b44c38445807ad74329416692d41046f2482b4c8ecc2e9c6d742fd8fa86b76bc

SHA512
7bdd4d23f636085a361b407fdeef87cbc679326468b69b7688b61af78bd726178a4ea25c4d45bfb329b1181eb0fc4b8ca625324aad29ef15402b782f3471fb74

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.ini

Filesize
9B

MD5
95b3e5fe04e8423c49a7f69a5d13771f

SHA1
615b63fb8bf07dbb0565ffd492067309645064c9

SHA256
1663db9b496c87701f6c8f6721e92994ffdd747f949ab1070fd844c4d63fb916

SHA512
d9a0d342e84c32d4c0aee97be7b9a102963d1aeab7edd87b080548f7dd144d851c558e6706bec441534d8e188938655c2b551e358d342309677511404a34ce81

Download Submit
memory/1160-29-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1376-90-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-38-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-697-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-1850-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-2400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-3310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-21-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2292-12-0x0000000000250000-0x0000000000285000-memory.dmp

Filesize
212KB

Download
memory/2292-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2292-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download