00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe
Size

70KB
MD5

d5e36de953e6c3db24a28349e7ceef46
SHA1

36611523b5f633b785d038b8358b1ac18c43630e
SHA256

00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902
SHA512

cceab54c0d5caf2941f466f0f98485315525ffd22ec376695d4c8caaccf87edb436b0549ceba85ebcc99cb2ee4c90e9612c29969be3cfda362cba7e21dabb0d0
SSDEEP

1536:pUi3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pUikuJVLtlZQKbgZi1St7xQ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1640	Logo1_.exe
2548	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe
File created	C:\Windows\Logo1_.exe	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe
1640	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2696	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	28
PID 2244 wrote to memory of 2696	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	28
PID 2244 wrote to memory of 2696	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	28
PID 2244 wrote to memory of 2696	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	28
PID 2244 wrote to memory of 1640	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	30
PID 2244 wrote to memory of 1640	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	30
PID 2244 wrote to memory of 1640	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	30
PID 2244 wrote to memory of 1640	2244	00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe	30
PID 1640 wrote to memory of 2620	1640	Logo1_.exe	31
PID 1640 wrote to memory of 2620	1640	Logo1_.exe	31
PID 1640 wrote to memory of 2620	1640	Logo1_.exe	31
PID 1640 wrote to memory of 2620	1640	Logo1_.exe	31
PID 2620 wrote to memory of 2676	2620	net.exe	34
PID 2620 wrote to memory of 2676	2620	net.exe	34
PID 2620 wrote to memory of 2676	2620	net.exe	34
PID 2620 wrote to memory of 2676	2620	net.exe	34
PID 2696 wrote to memory of 2548	2696	cmd.exe	33
PID 2696 wrote to memory of 2548	2696	cmd.exe	33
PID 2696 wrote to memory of 2548	2696	cmd.exe	33
PID 2696 wrote to memory of 2548	2696	cmd.exe	33
PID 1640 wrote to memory of 1268	1640	Logo1_.exe	21
PID 1640 wrote to memory of 1268	1640	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe
  "C:\Users\Admin\AppData\Local\Temp\00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8F45.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe
      "C:\Users\Admin\AppData\Local\Temp\00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe"
      4⤵
      Executes dropped EXE
      PID:2548
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
8dff5b606e028bbb0a756dc3cbfcee14

SHA1
1058ce726974305327c138a09ef4828da78bf8d0

SHA256
9d86b08d939cda9423a4cc3c4d041ad82478d23d6322202aa0bf1d05f42cc95e

SHA512
9496806722b18b67f9de28048cc499be4ddb4eebf38bedec11136f67aabcf79315e34bcb993f5a4cb31e9e22cc6ca3f6ddc17b7a8c26044e4df7e8cb7e25e72d

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
17e5de36cf448d652adab881a4557ec2

SHA1
c45337444120f4cc4a9a65b2bee63cd61618ca2a

SHA256
32568fb07078e0d4e77efac9ad862454dba63de5c5f920d9a14de709372f2430

SHA512
22678c9ca2d70d9a3377d1f2c6c91d7649adcaccee564acdf1bd6373e60f13f6e21fc09feed5b590475889996287961a1450542741ef0888a4a0b5e9c9812b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8F45.bat

Filesize
722B

MD5
7195c1f08423cc65f05cbe1b97963d57

SHA1
22824a2bcf8cf26545d3f485bd17befa4b6680eb

SHA256
6160c5072248e3bbb682aba0fd1fb683e1d6177f134a1b69a740719e7f8c5de7

SHA512
f6e538a76d216bbb7f969da229fa5b5537ab4053a6302ca349c9c724b324051e065828c4e97268882dbf31222e042e0c3d2ead6d3c2d5670239fc488eb3b9a07

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c71f84960ecf87b4d3e00bb6cd655cae0cf85c587bba112145832409bf7902.exe.exe

Filesize
41KB

MD5
977e405c109268909fd24a94cc23d4f0

SHA1
af5d032c2b6caa2164cf298e95b09060665c4188

SHA256
cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f

SHA512
12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
7930575fdfa898eda75149d939e08dc1

SHA1
0afed67d2a96979145d4711ec67e97e579187da4

SHA256
2dac1f581c4c037775ae430fd54fe5b266689764ec46818877ca1e657fd288ff

SHA512
f398fb83be0aa8a48181b6a9025876aaf440f80d35af4c32ffa7175be39cd26128275d5ddcfadc02a53b620b2b6549bc0924d3b49375d54cf0f2f9e4003d5e98

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
02ced53ce3f5b175c3bbec378047e7a7

SHA1
dafdf07efa697ec99b3d7b9f7512439a52ea618d

SHA256
485bb2341321a2837fd015a36963ea549c7c6f40985e165fd56c8a1e89b3f331

SHA512
669dde3ea8628704d40681a7f8974cf52985385c92a61a540c97c18c13eb4d451207ae171b2a56cd061cadbc90e672a84eb55111b1f5016846918d73fb075c99

Download Submit
memory/1268-29-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1640-195-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-46-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-1851-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-3311-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2244-20-0x00000000003B0000-0x00000000003E6000-memory.dmp

Filesize
216KB

Download
memory/2244-40-0x00000000003B0000-0x00000000003E6000-memory.dmp

Filesize
216KB

Download
memory/2244-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2244-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download