960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076

Analysis

max time kernel
101s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe
Size

5.7MB
MD5

862ff3ae77f95abc4ee876b02b8fea8f
SHA1

2458523746f40003dbfb61931fd04a9e84901041
SHA256

960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076
SHA512

bfa0940daf38314ca1faad6aa945f14a856d1a5ad6a21ba008305b317d6a4d6661d93ae67478fbd497916f70e35415bf3d09aa96c006da2bfbe0dfdd4623391b
SSDEEP

49152:9Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:JKUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2320	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2832	Logo1_.exe
2624	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Asia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe
File created	C:\Windows\Logo1_.exe	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe
2832	Logo1_.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2320	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	28
PID 2344 wrote to memory of 2320	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	28
PID 2344 wrote to memory of 2320	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	28
PID 2344 wrote to memory of 2320	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	28
PID 2344 wrote to memory of 2832	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	29
PID 2344 wrote to memory of 2832	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	29
PID 2344 wrote to memory of 2832	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	29
PID 2344 wrote to memory of 2832	2344	960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe	29
PID 2832 wrote to memory of 1812	2832	Logo1_.exe	31
PID 2832 wrote to memory of 1812	2832	Logo1_.exe	31
PID 2832 wrote to memory of 1812	2832	Logo1_.exe	31
PID 2832 wrote to memory of 1812	2832	Logo1_.exe	31
PID 1812 wrote to memory of 2648	1812	net.exe	34
PID 1812 wrote to memory of 2648	1812	net.exe	34
PID 1812 wrote to memory of 2648	1812	net.exe	34
PID 1812 wrote to memory of 2648	1812	net.exe	34
PID 2832 wrote to memory of 1356	2832	Logo1_.exe	21
PID 2832 wrote to memory of 1356	2832	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1356
- C:\Users\Admin\AppData\Local\Temp\960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe
  "C:\Users\Admin\AppData\Local\Temp\960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a648.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe
      "C:\Users\Admin\AppData\Local\Temp\960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe"
      4⤵
      Executes dropped EXE
      PID:2624
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
22d003d3f5edc56ca7ec1e07f50145db

SHA1
0a831d187f1e656e29900a871039f9682f1e3f10

SHA256
db47539501bb96d6ee9207e3021c989985864c5426b907cf330de7aca5058c70

SHA512
d0919f9a98731cc619ac07836f5e4dd6d8793665909fdb1d9de526be6ed7bd787bbfb52034a8596304cee07ced99635e7e966a88b79b3244c0fc169025558367

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
25408b7ff8c885c99c0429788fcc1320

SHA1
e5a91f3984dd3569a32a8b82c95a5430e828eb75

SHA256
ce5b5c337e6b25e7ea60ab1a528dcf8c70e952761b99c47a5051a17aabd9462c

SHA512
680cfc4bbcf7859075dd43a4a4e3a41084cd3e4783ad3fb35f1d9ee1971a3324ef132f65bd8afd9e245eb2ffcd27e02b035f1f96a0a97a06c37b620849d68c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a648.bat

Filesize
721B

MD5
c26ee6583639330adff10e696b7217af

SHA1
70e62419bc3112a083124dfafa5818ad216c99ae

SHA256
afb983546d76c1965daad35ae46b7dcd1ca84952ac51e91e76ba504f0621fbda

SHA512
a6508f3190ab909a0afed97ec9e93530cda80ddbd4110fcbd0744f33bf447a1b278ac1507855b5de5e7d8ce17c47eb3b00c6487455563655f9bc2d1a39e1d48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\960dd1411d56dc9c8e1a55cb9ef5a5455dad12d397f7724330be58cb4b81c076.exe.exe

Filesize
5.7MB

MD5
ba18e99b3e17adb5b029eaebc457dd89

SHA1
ec0458f3c00d35b323f08d4e1cc2e72899429c38

SHA256
f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

SHA512
1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
d8bdfe1646d2659fdb23730409bf38ae

SHA1
887fb9da472efab54f9af265cd7da777b3430db6

SHA256
9e4d074cb14179eecfb995d1fb507779698cc72ed445596ee23b9daf6966512a

SHA512
feb8ed7223513c3c0ae9593a6d396944f69d51ede7f7dcef7eb8e401a1a5cdd5fe5f3dd54716c6810e5458f737ecb90ad9a4493add1bd196354e1bb284b12939

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

Filesize
9B

MD5
2be02af4dacf3254e321ffba77f0b1c6

SHA1
d8349307ec08d45f2db9c9735bde8f13e27a551d

SHA256
766fe9c47ca710d9a00c08965550ee7de9cba2d32d67e4901e8cec7e33151d16

SHA512
57f61e1b939ed98e6db460ccdbc36a1460b727a99baac0e3b041666dedcef11fcd72a486d91ec7f0ee6e1aec40465719a6a5c22820c28be1066fe12fcd47ddd0

Download Submit
memory/1356-29-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/2344-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2344-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2344-17-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2832-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-1032-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-3272-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2832-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download