210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe
Size

354KB
MD5

b8984178e05b1341f5879a2b55de4136
SHA1

eee45e2e9cce251301c5fe25613433e488cfe9a2
SHA256

210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201
SHA512

2c3cf8e83d37c749ec1b3b2a2b7a5806c9f3bb4fba27abdbce77c8bd94a6a71a2d1c6055e1a34c70cd6b50792a3ba741f4beef1c03e998352484d51bdea7bed3
SSDEEP

6144:8VfjmNsIla7NtmPcNGCFmiuhw9YE29SnKqFULHdkgZ3rfxbXKoIZP/sVn:+7+sjtZ4iuhw9YfAKEujpb6/ZP/sVn

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1176	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2336	Logo1_.exe
2672	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe

Loads dropped DLL 1 IoCs

pid	Process
1176	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe
2336	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1176	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	28
PID 1068 wrote to memory of 1176	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	28
PID 1068 wrote to memory of 1176	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	28
PID 1068 wrote to memory of 1176	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	28
PID 1068 wrote to memory of 2336	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	30
PID 1068 wrote to memory of 2336	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	30
PID 1068 wrote to memory of 2336	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	30
PID 1068 wrote to memory of 2336	1068	210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe	30
PID 2336 wrote to memory of 3060	2336	Logo1_.exe	31
PID 2336 wrote to memory of 3060	2336	Logo1_.exe	31
PID 2336 wrote to memory of 3060	2336	Logo1_.exe	31
PID 2336 wrote to memory of 3060	2336	Logo1_.exe	31
PID 3060 wrote to memory of 2668	3060	net.exe	33
PID 3060 wrote to memory of 2668	3060	net.exe	33
PID 3060 wrote to memory of 2668	3060	net.exe	33
PID 3060 wrote to memory of 2668	3060	net.exe	33
PID 1176 wrote to memory of 2672	1176	cmd.exe	34
PID 1176 wrote to memory of 2672	1176	cmd.exe	34
PID 1176 wrote to memory of 2672	1176	cmd.exe	34
PID 1176 wrote to memory of 2672	1176	cmd.exe	34
PID 2336 wrote to memory of 1244	2336	Logo1_.exe	21
PID 2336 wrote to memory of 1244	2336	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe
  "C:\Users\Admin\AppData\Local\Temp\210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a319B.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe
      "C:\Users\Admin\AppData\Local\Temp\210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe"
      4⤵
      Executes dropped EXE
      PID:2672
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
017b5ff3fe0c3468438be2ec74cebc30

SHA1
6c3d43933b458fc53062a5d51b8d9570be6d3e2d

SHA256
f23e73059d7cbbe7cc9f6a50932f5aa26d25feaf6e1a32c35cd01fa49183a619

SHA512
cb317a0becd259af4982ae63e97a1205c250a9cf09b47fbb0460eb2bcbe93421014f49f72c33b51dcd7517034be9b95b09ab7c0312cd79bf5b41b4fd8df6ac77

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
99ea9b604a7a734d3087fa6159684c42

SHA1
709fa1068ad4d560fe03e05b68056f1b0bedbfc8

SHA256
3f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c

SHA512
7af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a319B.bat

Filesize
722B

MD5
378e530d28a753d67baea4a9e60c6852

SHA1
cada7dc65d305c02ea93f64a11542c5dfe38b606

SHA256
b13c21a38a67fcab14d260f2a476f966dab3df6b260bd4bbbbe12ae1e628f24b

SHA512
4b5942f7a029778a8cddab41bcb0cf0f9391f011ba5b112884ca5cb3a3bdd498c2bb5def81b63733fe2109f247130368e61019833c51e1d46179ff1445c87b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\210472eacc6001145b71b2915a54cb2e25cbe2da132dddf6799ce5ef94ba8201.exe.exe

Filesize
328KB

MD5
926b26e3fc9707ec5c760feee6275d6d

SHA1
4f31e72b46b6725270402f93811ed5630e1e8787

SHA256
c504578222da4fe8a7fad9ededf918a3286153d9780e9c18090580b01a3d3b73

SHA512
3a41fc7a67a5791bb1b320924ce46573a449a0b94bb69cbbb292c3cc703938305216c2ce861c59bac219cac0da26741541a7f1ef15afff083d4152f49ec7b157

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
d375bd04f866e1b3276ba3b9779966ad

SHA1
1da9855e29a5384522563e0c4bdac786712d8b12

SHA256
a540c3c24ac2e3e353f3e0376889b61d7c11c926b29c8f0b8c768aea37daf7be

SHA512
78aa0651eeebb8475328fb7090ef3bdc8984ea22c888365727fd7c09533d59873599fc172d291fbadc55e04034fa62e7be405cd501df063105b0c03d7638de10

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2610426812-2871295383-373749122-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1068-12-0x0000000001B90000-0x0000000001BC4000-memory.dmp

Filesize
208KB

Download
memory/1068-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1068-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1244-29-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2336-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-46-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-1867-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-3327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download