5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe
Size

573KB
MD5

83a99a4f97d76fe249db977ea776e7ea
SHA1

44879e1ab8ab46e0ac6adf31ae18dc87289aa66f
SHA256

5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4
SHA512

bc8024fc0b299314cd38851d89b5861cea5ba00758cf3145e2f08fe42f81390767d6d312b02ff0f42a0425fc817cd64eb474d71af22c89a839922746a4860e16
SSDEEP

6144:OuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:G7a3iwbihym2g7XO3LWUQfh4Co

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2228	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2592	Logo1_.exe
2416	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe

Loads dropped DLL 1 IoCs

pid	Process
2228	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe
File created	C:\Windows\Logo1_.exe	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe
2592	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2228	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	28
PID 1964 wrote to memory of 2228	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	28
PID 1964 wrote to memory of 2228	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	28
PID 1964 wrote to memory of 2228	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	28
PID 1964 wrote to memory of 2592	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	29
PID 1964 wrote to memory of 2592	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	29
PID 1964 wrote to memory of 2592	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	29
PID 1964 wrote to memory of 2592	1964	5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe	29
PID 2592 wrote to memory of 2264	2592	Logo1_.exe	30
PID 2592 wrote to memory of 2264	2592	Logo1_.exe	30
PID 2592 wrote to memory of 2264	2592	Logo1_.exe	30
PID 2592 wrote to memory of 2264	2592	Logo1_.exe	30
PID 2264 wrote to memory of 2740	2264	net.exe	33
PID 2264 wrote to memory of 2740	2264	net.exe	33
PID 2264 wrote to memory of 2740	2264	net.exe	33
PID 2264 wrote to memory of 2740	2264	net.exe	33
PID 2228 wrote to memory of 2416	2228	cmd.exe	34
PID 2228 wrote to memory of 2416	2228	cmd.exe	34
PID 2228 wrote to memory of 2416	2228	cmd.exe	34
PID 2228 wrote to memory of 2416	2228	cmd.exe	34
PID 2592 wrote to memory of 1216	2592	Logo1_.exe	21
PID 2592 wrote to memory of 1216	2592	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe
  "C:\Users\Admin\AppData\Local\Temp\5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a18CE.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe
      "C:\Users\Admin\AppData\Local\Temp\5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe"
      4⤵
      Executes dropped EXE
      PID:2416
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
8dff5b606e028bbb0a756dc3cbfcee14

SHA1
1058ce726974305327c138a09ef4828da78bf8d0

SHA256
9d86b08d939cda9423a4cc3c4d041ad82478d23d6322202aa0bf1d05f42cc95e

SHA512
9496806722b18b67f9de28048cc499be4ddb4eebf38bedec11136f67aabcf79315e34bcb993f5a4cb31e9e22cc6ca3f6ddc17b7a8c26044e4df7e8cb7e25e72d

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
17e5de36cf448d652adab881a4557ec2

SHA1
c45337444120f4cc4a9a65b2bee63cd61618ca2a

SHA256
32568fb07078e0d4e77efac9ad862454dba63de5c5f920d9a14de709372f2430

SHA512
22678c9ca2d70d9a3377d1f2c6c91d7649adcaccee564acdf1bd6373e60f13f6e21fc09feed5b590475889996287961a1450542741ef0888a4a0b5e9c9812b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a18CE.bat

Filesize
722B

MD5
2499216ddf1a81b7e6dedd7509ae6bd7

SHA1
77bf776389c59df30e7da29cb0e5fed6efea3004

SHA256
4194181c31bd8ff10af278f42f6c15be88e1f770f0b213bd74bcdf05fbbafae0

SHA512
f847649c5ef2cba8a3a0d756504d2bb92848259cbc4252e867aeeebacc7a45ec0e226d2e9459716d997d760d2dc978b53b661a42b349ac671f0fc8111db0e89a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a791f38a56c6a41be7217b7a53ce336ad06165cf977104ce856fb76b84474f4.exe.exe

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
7930575fdfa898eda75149d939e08dc1

SHA1
0afed67d2a96979145d4711ec67e97e579187da4

SHA256
2dac1f581c4c037775ae430fd54fe5b266689764ec46818877ca1e657fd288ff

SHA512
f398fb83be0aa8a48181b6a9025876aaf440f80d35af4c32ffa7175be39cd26128275d5ddcfadc02a53b620b2b6549bc0924d3b49375d54cf0f2f9e4003d5e98

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\_desktop.ini

Filesize
9B

MD5
02ced53ce3f5b175c3bbec378047e7a7

SHA1
dafdf07efa697ec99b3d7b9f7512439a52ea618d

SHA256
485bb2341321a2837fd015a36963ea549c7c6f40985e165fd56c8a1e89b3f331

SHA512
669dde3ea8628704d40681a7f8974cf52985385c92a61a540c97c18c13eb4d451207ae171b2a56cd061cadbc90e672a84eb55111b1f5016846918d73fb075c99

Download Submit
memory/1216-29-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1964-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1964-16-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/1964-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-998-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-2928-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2592-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download