Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 06:41
Static task
static1
Behavioral task
behavioral1
Sample
02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe
Resource
win10v2004-20240412-en
General
-
Target
02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe
-
Size
1.1MB
-
MD5
e0fc3ce37373fb2921c678f48039dcac
-
SHA1
b7bb47d28579422c11dad710994dde7c3dc724d8
-
SHA256
02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65
-
SHA512
d688c1fcb277f1ceaf7467a8e7ee9f6f16593575ba26870838fae520f2598efb779aa3b67b719b155dc9407b9c63dd8a86e5fb157f03842937cc814bf9b56a7b
-
SSDEEP
12288:17+Cxdvr88vCmgFXD4LDKLuxke/jHjQjd92qsrIWOywbk:175dv4J3xD4DS2ke7D6dgxrzZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2708 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2628 Logo1_.exe 2872 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe -
Loads dropped DLL 2 IoCs
pid Process 2708 cmd.exe 2708 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe File created C:\Windows\Logo1_.exe 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe 2628 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2708 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 28 PID 2780 wrote to memory of 2708 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 28 PID 2780 wrote to memory of 2708 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 28 PID 2780 wrote to memory of 2708 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 28 PID 2780 wrote to memory of 2628 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 29 PID 2780 wrote to memory of 2628 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 29 PID 2780 wrote to memory of 2628 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 29 PID 2780 wrote to memory of 2628 2780 02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe 29 PID 2628 wrote to memory of 2600 2628 Logo1_.exe 31 PID 2628 wrote to memory of 2600 2628 Logo1_.exe 31 PID 2628 wrote to memory of 2600 2628 Logo1_.exe 31 PID 2628 wrote to memory of 2600 2628 Logo1_.exe 31 PID 2600 wrote to memory of 2492 2600 net.exe 33 PID 2600 wrote to memory of 2492 2600 net.exe 33 PID 2600 wrote to memory of 2492 2600 net.exe 33 PID 2600 wrote to memory of 2492 2600 net.exe 33 PID 2708 wrote to memory of 2872 2708 cmd.exe 34 PID 2708 wrote to memory of 2872 2708 cmd.exe 34 PID 2708 wrote to memory of 2872 2708 cmd.exe 34 PID 2708 wrote to memory of 2872 2708 cmd.exe 34 PID 2628 wrote to memory of 1192 2628 Logo1_.exe 21 PID 2628 wrote to memory of 1192 2628 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a4CB9.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe"4⤵
- Executes dropped EXE
PID:2872
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2492
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5e9325483409732a224d105e072546fa8
SHA1d23d39592deace449a7bf98427525d34b106b444
SHA256116a778a061a28cd9dd0d3c028fb8982daa3e3ca84e6f33b56f13bc4fa3c1a78
SHA512836d9b24a28b54f734c6d7e9bbb56f301db8a991a53310f9dffd620f76bf798ef1aa8f362b6cd330ec9c146095b6410f9cb174ff54f7b58322f1abd82818db59
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD52c72c5702e95f19f5c30046d40413b58
SHA16327efcc5cde06be797ee0ab308f171e65ff3729
SHA25646f0b649dfd30ae8a3e9ef0ed6cdaec4f162842d1350f74b317584d3beff8da8
SHA5127e3b1d6614b0338f5a1791cb6dba7fa3d15a7c29c49cf8fb7e199210d025aaab8e4212da7301058189079a4c23ef9fece71f8f8a85b2c27b5cb354787600648e
-
C:\Users\Admin\AppData\Local\Temp\02a87664855f08c28fb3fa4600f576e17802f17e955dd4216fd2fb33ec44dd65.exe.exe
Filesize1.0MB
MD5f98dde375e9e4c61b54f48893aaeb07b
SHA1f8fff1dd387401c4f4946aca7c524cd210b5f144
SHA2566a1de5fe8f94bc3d7ebdbf8f82a8fedb03d9f9ed16ebfa5883b4e418ce902dc2
SHA512d3dfce3b9bdf553bc043d585c53acbbac69adcce490b48c39408a067512479f52db3916ea9a4b08cbb02df49135b1480416707977f5631fb2a1d21b4c26e7df5
-
Filesize
26KB
MD58922a4ac9c38bcb52124f9efe7e77593
SHA1d3ed9dd3a8326e982d90926ced067b1a4bb5a663
SHA256fece29ead615f8a7a4a13a36b8415c0fa517cc62954b77ca0c7dedb13a20a0d6
SHA5122e17a7c3247b5c38f89b8cb9b502bd92bbb50966662479e9fd476c207e2e1678d394fc3bb9fd3e06e2b83e9b05a83def8a0539fedeb1842f38f0cdcd01363c5c
-
Filesize
9B
MD572b7e38c6ba037d117f32b55c07b1a9c
SHA135e2435e512e17ca2be885e17d75913f06b90361
SHA256e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6
SHA5122bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a