00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe
Size

1.7MB
MD5

816d76d1e1377546ba1521373f912255
SHA1

da353cdf0091505b3ca4dbf251eb47c2bcbb6e0a
SHA256

00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52
SHA512

5814bfb957f28ce49bc4c1dc0b12140555286ac36927d1f6200fe7812fed4f62c794c31a6987ec07518ef06f57699c5ec72aa7253efcb937e822b6004d5b281c
SSDEEP

49152:c7xFdZ6npCxnngx1oZ7zIFqrFG2RFzbh:8BxnkoZ79n

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2820	Logo1_.exe
2676	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\az\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe
File created	C:\Windows\Logo1_.exe	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe
2820	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2192	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	28
PID 2232 wrote to memory of 2192	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	28
PID 2232 wrote to memory of 2192	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	28
PID 2232 wrote to memory of 2192	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	28
PID 2232 wrote to memory of 2820	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	30
PID 2232 wrote to memory of 2820	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	30
PID 2232 wrote to memory of 2820	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	30
PID 2232 wrote to memory of 2820	2232	00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe	30
PID 2820 wrote to memory of 2316	2820	Logo1_.exe	31
PID 2820 wrote to memory of 2316	2820	Logo1_.exe	31
PID 2820 wrote to memory of 2316	2820	Logo1_.exe	31
PID 2820 wrote to memory of 2316	2820	Logo1_.exe	31
PID 2192 wrote to memory of 2676	2192	cmd.exe	33
PID 2192 wrote to memory of 2676	2192	cmd.exe	33
PID 2192 wrote to memory of 2676	2192	cmd.exe	33
PID 2192 wrote to memory of 2676	2192	cmd.exe	33
PID 2316 wrote to memory of 2652	2316	net.exe	34
PID 2316 wrote to memory of 2652	2316	net.exe	34
PID 2316 wrote to memory of 2652	2316	net.exe	34
PID 2316 wrote to memory of 2652	2316	net.exe	34
PID 2820 wrote to memory of 1360	2820	Logo1_.exe	21
PID 2820 wrote to memory of 1360	2820	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Users\Admin\AppData\Local\Temp\00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe
  "C:\Users\Admin\AppData\Local\Temp\00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aFE8.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe
      "C:\Users\Admin\AppData\Local\Temp\00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe"
      4⤵
      Executes dropped EXE
      PID:2676
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
f571ac45e8ad5b10e044a6a7b3e50ab5

SHA1
f68acef0db816eb2257ef292a0055fa723522131

SHA256
8e8e25961e30350f0c04ecc428e5e93a2fb6d5adfa7feb537d0d1cb054db5a3b

SHA512
e636256459d8d251d97417eb63a038405d17f3f3b47a70cfb6ba4c0e386f24aee8dad9a792eee4719084293cd0d76839f3fddf7d957b58dc46337eb3389490db

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aFE8.bat

Filesize
721B

MD5
12a3b8ecf3f2b99e932a3bed4f5319cc

SHA1
dad4b14f1926ff557489569ed9029654dd31bec6

SHA256
51d3d59adcadd9e1aad620a4849e1f268264b834f6123ad859f7ee9c2e7c82b1

SHA512
8aae448b9624e2de5cb89a7690584a9c1128586076254fd18981bc750bafd0ea25370c646865ea59c80b10968aa66f518b3b2a62631c079da2c66347de6179e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\00895107e25485d3536c8898fc8b24e0dd6ec84461bebc705497b06bcf5dbe52.exe.exe

Filesize
1.7MB

MD5
93d201ce0e1f14b03096ed19074635de

SHA1
9175c5e7f344c6253796fbfe9b10c3205d051138

SHA256
6dd4837f317ab965386fb24558476709045291d93a8a86ad696ac7d8251dd16c

SHA512
6f632df1bf6210ff767ea9ff89a1702eeb16a832c868d5f6bcb4800d8f7c3e673e8690c792b33572e9afbc1b3c476c03ea03a456d193e753f3477999c5c61dff

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
59b6f2680ede09b8bd4f473995ed3721

SHA1
11e97db0d3247b8ea6e4f1b92e370993ca8d511f

SHA256
60717da5e3048f422cd7d686a7294a85c3067ae60a82b4d8ce8b2584d732de56

SHA512
ad1cb9350d328e8323bba383e9f3903f69722471955165506b252aec071ef3525dc821a7b575b220c1804080b4fddd0987f0fab39640a83cf7cce5040c785279

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

Filesize
9B

MD5
2be02af4dacf3254e321ffba77f0b1c6

SHA1
d8349307ec08d45f2db9c9735bde8f13e27a551d

SHA256
766fe9c47ca710d9a00c08965550ee7de9cba2d32d67e4901e8cec7e33151d16

SHA512
57f61e1b939ed98e6db460ccdbc36a1460b727a99baac0e3b041666dedcef11fcd72a486d91ec7f0ee6e1aec40465719a6a5c22820c28be1066fe12fcd47ddd0

Download Submit
memory/1360-30-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2232-18-0x00000000002E0000-0x0000000000314000-memory.dmp

Filesize
208KB

Download
memory/2232-17-0x00000000002E0000-0x0000000000314000-memory.dmp

Filesize
208KB

Download
memory/2232-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2232-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-91-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-886-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-3183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-3310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download