0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
Size

227KB
MD5

a4beb9a2482f287d735062783fee91a7
SHA1

5baea2317e8bac3f089365e62eca4d2e4c7f5c2e
SHA256

0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310
SHA512

422f860ecb16586d20eb62767b7173cbdc8271735745202f8598c4db7a88a56775efa40dcd88cbfdaeb074751ce6e5353176624e0f5a36c0a07a56b547219404
SSDEEP

3072:pTkuJVLUdeKzC/lzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5n:SuJWdeKzC/leySe8AIqpoHbnDns1ND9m

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2596	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1956	Logo1_.exe
2632	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe

Loads dropped DLL 1 IoCs

pid	Process
2596	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
File created	C:\Windows\Logo1_.exe	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe
1956	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2596	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	28
PID 2220 wrote to memory of 2596	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	28
PID 2220 wrote to memory of 2596	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	28
PID 2220 wrote to memory of 2596	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	28
PID 2220 wrote to memory of 1956	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	30
PID 2220 wrote to memory of 1956	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	30
PID 2220 wrote to memory of 1956	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	30
PID 2220 wrote to memory of 1956	2220	0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe	30
PID 1956 wrote to memory of 2564	1956	Logo1_.exe	31
PID 1956 wrote to memory of 2564	1956	Logo1_.exe	31
PID 1956 wrote to memory of 2564	1956	Logo1_.exe	31
PID 1956 wrote to memory of 2564	1956	Logo1_.exe	31
PID 2564 wrote to memory of 2804	2564	net.exe	33
PID 2564 wrote to memory of 2804	2564	net.exe	33
PID 2564 wrote to memory of 2804	2564	net.exe	33
PID 2564 wrote to memory of 2804	2564	net.exe	33
PID 2596 wrote to memory of 2632	2596	cmd.exe	34
PID 2596 wrote to memory of 2632	2596	cmd.exe	34
PID 2596 wrote to memory of 2632	2596	cmd.exe	34
PID 2596 wrote to memory of 2632	2596	cmd.exe	34
PID 1956 wrote to memory of 1208	1956	Logo1_.exe	21
PID 1956 wrote to memory of 1208	1956	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
  "C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a8CD5.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe
      "C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe"
      4⤵
      Executes dropped EXE
      PID:2632
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
fb33dbc4b5d5b31cf6058c1bcb2c0816

SHA1
0c0d5e2fff30026710694fe21cf9b22378413fe1

SHA256
44b6bae974236d6f36331839d21b67cd74b6d57fe01937edbc393863a83d2197

SHA512
4069f91e24f71d92313a6acbf6a52f173cd71077fb8bea412bf98b68324627a72e6b6d0b755cb2b7f08fd56cd9ace4c4d65c2370d8842cf55361cfbfef79ba7f

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
8beab7d90559fe385c30b08b3cc454d2

SHA1
65e627284e5c6b1a28618d976575bbade15d7160

SHA256
3662c245331ac74241676bc8de866ceadf1b77fd58bd094b05f8921c287f7995

SHA512
5c2544684b45354d204d6be7548c57a7e3b00f4042d535dfd2ac4670a99f2ca0590bcd781992178ccf83e56af38db13d646c10c166a05983ebdb050441d2d887

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8CD5.bat

Filesize
722B

MD5
ae78515057b72462c67ea32f21016e0c

SHA1
181bd739e03eb007884d03aa0e47a239c90f0d2a

SHA256
8a87d428cee25b341ee7e6a11c066d0c374b730034f512670461314ba439673b

SHA512
bcada8665543cff8449ba660acefca871add1d6af4445242cf8e43f1ba97e9f7ebb47f03e86ea4ab8efd99fdb95c3e211914c1b4e187ce1e9ecc0ea0ee072820

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ed217237999c6401e2105c121caf1cfd0b0d061a85919b416d298c5510dc310.exe.exe

Filesize
198KB

MD5
e133c2d85cff4edd7fe8e8f0f8be6cdb

SHA1
b8269209ebb6fe44bc50dab35f97b0ae244701b4

SHA256
6c5e7d9c81a409e67c143cd3aed33bddc3967fa4c9ab3b98560b7d3bf57d093d

SHA512
701b7d1c7e154519d77043f7de09d60c1ff76c95f820fc1c9afca19724efb0847d646686053354156fd4e8a9dab1f29a79d3223f939a3ff1b3613770dc8603b1

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
2151384a3dd2ba8bf06344750c79ec50

SHA1
9a11f78359b6e63f377e53d4b8f6729973108352

SHA256
dcb31868a407145437cddb08a1bd348abf98b690abae375ce417fdd74b016eec

SHA512
30ba1c9309e477250ae60c96a7d046eb683c31ae57520a539bb5f668142b2f8fb51a4cde02b39d6bf149a6dbd68b9a1478a569aaaa75667927c5fcbcdafa4677

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1208-29-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/1956-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-45-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-258-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2220-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2220-17-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/2220-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download