59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe
Size

261KB
MD5

c293e885f071d54edbdc3c434c73f093
SHA1

f061ac87a0f974df6d4e95858991ff188b76f151
SHA256

59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b
SHA512

23c8a84bc8e1c601b96ad7292340883c111a02fd5e3fe5468dd991a2274c06feee46c84753b97bdd5d72233370551c408cb320f91d12a7c2c79b47d011217c71
SSDEEP

6144:WuJXaU0V3teOOdlcwTCN5hDxchFYgqPi2X:OTvEcwTCNwIaI

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1932	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1752	Logo1_.exe
2644	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe

Loads dropped DLL 1 IoCs

pid	Process
1932	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\jfr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Uninstall Information\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe
File created	C:\Windows\Logo1_.exe	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe
1752	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1932	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	28
PID 2888 wrote to memory of 1932	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	28
PID 2888 wrote to memory of 1932	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	28
PID 2888 wrote to memory of 1932	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	28
PID 2888 wrote to memory of 1752	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	30
PID 2888 wrote to memory of 1752	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	30
PID 2888 wrote to memory of 1752	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	30
PID 2888 wrote to memory of 1752	2888	59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe	30
PID 1752 wrote to memory of 2528	1752	Logo1_.exe	31
PID 1752 wrote to memory of 2528	1752	Logo1_.exe	31
PID 1752 wrote to memory of 2528	1752	Logo1_.exe	31
PID 1752 wrote to memory of 2528	1752	Logo1_.exe	31
PID 2528 wrote to memory of 2628	2528	net.exe	33
PID 2528 wrote to memory of 2628	2528	net.exe	33
PID 2528 wrote to memory of 2628	2528	net.exe	33
PID 2528 wrote to memory of 2628	2528	net.exe	33
PID 1932 wrote to memory of 2644	1932	cmd.exe	34
PID 1932 wrote to memory of 2644	1932	cmd.exe	34
PID 1932 wrote to memory of 2644	1932	cmd.exe	34
PID 1932 wrote to memory of 2644	1932	cmd.exe	34
PID 1752 wrote to memory of 1260	1752	Logo1_.exe	21
PID 1752 wrote to memory of 1260	1752	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe
  "C:\Users\Admin\AppData\Local\Temp\59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a29EE.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe
      "C:\Users\Admin\AppData\Local\Temp\59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe"
      4⤵
      Executes dropped EXE
      PID:2644
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
009b657f7f7a457e7a4570f483706785

SHA1
5683c4e7a0b659a7513199f8b1f7c4a743851be0

SHA256
8c998f47bfb4b2af4afd218f345035643257506e6f65bdd0295d64f1ee5fbb89

SHA512
44d0b7ff02564058639675501006a5ca95a83709f5c4117b1d18d228728ff5509dba21bc6a4c2fba863ffa1a55363009450c28467d7db0cdda986b12a32d1763

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
429fb3aac1d07c0cd8c5a4c20c7c9660

SHA1
74e91983300cf65cc7c4213e0cd713f63bca551c

SHA256
0b250ae1b76b37a02003f0b7ac2d2b428e1df177503693060003a74c3551ca2d

SHA512
e384f604304e72b1d19819c53702c109953bf29538ab983aaeb5611dc171e5ccdf521889cd4aeb4f3f53e028e8366e5acf9f5de96612b1d009511d45dbc5a55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a29EE.bat

Filesize
722B

MD5
8ce04d858bc6a1479966b850ab468543

SHA1
53cdb082435157a80d43356c77530d0643751f76

SHA256
83977080f34d63aa847ff4d9345dfc187016499ea1aee73f3ae1e4c0f6ed5111

SHA512
204be36d00b1a83abc5a82735491067726dbac882463edeb51789472b7ec6d2e5242dc849cdb9e743e4144513b95a00a6a793cf5b89ec681addbee409c528d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\59efd00a32a5aaace06125c207cc33d50b85474d37260f6ef937f335ecbbe92b.exe.exe

Filesize
231KB

MD5
b6098de8baed9ead05827a57ff5cc08d

SHA1
5042f3710a5572aae765637d822d2f222beebdcb

SHA256
b90dd11047629bf672ed515f64311a6a6d468544230570c5ab50284d4084af2c

SHA512
11c96ac7f9a8b6dbc4260afd9dc991c7ad72fc8761572000141a942bb00046e94d32f1d85412483dbafe032a56f693bf8861ac1aec928c3dfd535ea1b9e9f877

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
69f3dc136ebf637ccd58e7686fb263b9

SHA1
41d1241c621782e2edfc5673f4b17a3934382504

SHA256
e205289e0a83f8fd7e26b98ba3967eb96ea390b24a46f4e1e06d8f7d9a377a1a

SHA512
9c118158fdc1f0a41c7b1b0b3f0fbeb5b64100702677d35ba81441afeb8f15aa26f07d8e7e8b290476b51a1f5687449143013dc5c2fada0b4bceb1d7918a57e2

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2610426812-2871295383-373749122-1000\_desktop.ini

Filesize
9B

MD5
2be02af4dacf3254e321ffba77f0b1c6

SHA1
d8349307ec08d45f2db9c9735bde8f13e27a551d

SHA256
766fe9c47ca710d9a00c08965550ee7de9cba2d32d67e4901e8cec7e33151d16

SHA512
57f61e1b939ed98e6db460ccdbc36a1460b727a99baac0e3b041666dedcef11fcd72a486d91ec7f0ee6e1aec40465719a6a5c22820c28be1066fe12fcd47ddd0

Download Submit
memory/1260-29-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/1752-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-45-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-91-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-97-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-342-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-1866-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-21-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1752-3326-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2888-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2888-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2888-16-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download