Analysis
-
max time kernel
92s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe
-
Size
44KB
-
MD5
770677aa8fe757f7d83881d9649229ce
-
SHA1
dc6595c29f2edabbaea280fc9461a00e7c629c3e
-
SHA256
2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0
-
SHA512
b03cf232330d3a6b674fc8ad3438ff45e75822cd860d2e89ea86cbc91500df1cc3a736df22e520510aff3ab489b8778b2e387d975b2808a439e6332cf1f389f9
-
SSDEEP
768:E7wT2ljlL5b+n8WF6z6zq8bW+g5L6wLvo4nF0fUFKPv2QrFheR6zEuR:E7bj95b+n8wZq8b05LjFKPvRhc2Eu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4760 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe File created C:\Windows\Logo1_.exe 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 4696 4760 WerFault.exe 89 812 4760 WerFault.exe 89 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe 4760 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4452 wrote to memory of 1820 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 88 PID 4452 wrote to memory of 1820 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 88 PID 4452 wrote to memory of 1820 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 88 PID 4452 wrote to memory of 4760 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 89 PID 4452 wrote to memory of 4760 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 89 PID 4452 wrote to memory of 4760 4452 2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe 89 PID 4760 wrote to memory of 2344 4760 Logo1_.exe 91 PID 4760 wrote to memory of 2344 4760 Logo1_.exe 91 PID 4760 wrote to memory of 2344 4760 Logo1_.exe 91 PID 2344 wrote to memory of 3292 2344 net.exe 93 PID 2344 wrote to memory of 3292 2344 net.exe 93 PID 2344 wrote to memory of 3292 2344 net.exe 93 PID 4760 wrote to memory of 3496 4760 Logo1_.exe 56 PID 4760 wrote to memory of 3496 4760 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe"C:\Users\Admin\AppData\Local\Temp\2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a659F.bat3⤵PID:1820
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3292
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 7444⤵
- Program crash
PID:4696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 9564⤵
- Program crash
PID:812
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4760 -ip 47601⤵PID:1656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4760 -ip 47601⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD59c711d1788319c325cc0afead185403f
SHA1f309665b8d100d6580d4caafbfb2ce1ae5dde3d9
SHA2561b2dbc3c45e53572949e96fe4012163f76f617e603b38a34d1da1988cfca0a17
SHA5121e4fab31ffc8da6252743f7cc76829ed81c91d026aa257e02e59c7c942604da9b20ca3058dfa063cfdc12213cfc47cc2cbc49f987c1fd0db44c318b49e016a3a
-
Filesize
722B
MD5f04c43c4479860580e82db4c975fe24b
SHA17e3f775bcad1979f8df8103b9bc48c1dc8d84980
SHA256c135cfac63ea2c72ecc36db8d5ac86aa17f4ac25bdf8d08c5ea6ed6171d2f237
SHA512eb15f0d72232b7f96b9385ddfed7ab79fb0668bf20b57ff58be87d2f0def913f2321e64c93fa361d717c3d46a8d429095ce71efbbca56dcddef5d5817475f7bf
-
C:\Users\Admin\AppData\Local\Temp\2ec1e50eb7a857c277121df60ce270297942379f5902d6d6ff724c75b2c7d7e0.exe.exe
Filesize57B
MD5fe5caf37c0b4607155add04f27bc07d9
SHA1aca97217c0e43d8d9315a08f1843aef1b18c37ee
SHA256b0b293dc8f146fdbba6f6e3a97e9845dbdf4b7aa96b4b74eb63b06653585750b
SHA51230087f9dc3f692023a264d84df482b9f4cd40b0b0fbffa1516afa91f1c8dc0f47ce2a957e2df544e47184f9706542a58ae49f6cace6c834f576f699b31e8ae48
-
Filesize
43KB
MD57dcba2547018dac956fb2009071b7645
SHA1f42360ef36dd23d1ed1233022fdc194df3b274c5
SHA256b1c7a31f00fab9fc58df21a8b17fbfcd09787260b4b576b8c2c3f6d9c58b83a5
SHA5121f309fd880a182e2ad09256f861d608f4ee9f63acae9c9411f3a608f915f5960eb5bdc29d0e0fe4387514d847473910386f095781d598e93b634566cfdcea47e
-
Filesize
9B
MD52be02af4dacf3254e321ffba77f0b1c6
SHA1d8349307ec08d45f2db9c9735bde8f13e27a551d
SHA256766fe9c47ca710d9a00c08965550ee7de9cba2d32d67e4901e8cec7e33151d16
SHA51257f61e1b939ed98e6db460ccdbc36a1460b727a99baac0e3b041666dedcef11fcd72a486d91ec7f0ee6e1aec40465719a6a5c22820c28be1066fe12fcd47ddd0