3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94

Analysis

max time kernel
159s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe
Size

88KB
MD5

95340c4fc044c3e62015ee1b605ac039
SHA1

3caedc850ef52af196c8c713fd1b2957794f8acd
SHA256

3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94
SHA512

b0861f6e99aca401b86ee77e7191f623b97ce422514decf1589fa1cf5405c2bf02cd53f9aa8625ee0752ef6185a7dd8abcfc835aea5edc528a290c8a310021aa
SSDEEP

1536:pC3SHuJV9Ntyapmebn4ddJZeY86iLflLJYEIs67rxo:pCkuJVL8LK4ddJMY86ipmns6S

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2920	Logo1_.exe
1928	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe

Loads dropped DLL 1 IoCs

pid	Process
2684	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Offline\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe
File created	C:\Windows\Logo1_.exe	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe
2920	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2684	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	28
PID 2516 wrote to memory of 2684	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	28
PID 2516 wrote to memory of 2684	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	28
PID 2516 wrote to memory of 2684	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	28
PID 2516 wrote to memory of 2920	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	30
PID 2516 wrote to memory of 2920	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	30
PID 2516 wrote to memory of 2920	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	30
PID 2516 wrote to memory of 2920	2516	3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe	30
PID 2920 wrote to memory of 2584	2920	Logo1_.exe	31
PID 2920 wrote to memory of 2584	2920	Logo1_.exe	31
PID 2920 wrote to memory of 2584	2920	Logo1_.exe	31
PID 2920 wrote to memory of 2584	2920	Logo1_.exe	31
PID 2684 wrote to memory of 1928	2684	cmd.exe	33
PID 2684 wrote to memory of 1928	2684	cmd.exe	33
PID 2684 wrote to memory of 1928	2684	cmd.exe	33
PID 2684 wrote to memory of 1928	2684	cmd.exe	33
PID 2584 wrote to memory of 2592	2584	net.exe	34
PID 2584 wrote to memory of 2592	2584	net.exe	34
PID 2584 wrote to memory of 2592	2584	net.exe	34
PID 2584 wrote to memory of 2592	2584	net.exe	34
PID 2920 wrote to memory of 1456	2920	Logo1_.exe	21
PID 2920 wrote to memory of 1456	2920	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1456
- C:\Users\Admin\AppData\Local\Temp\3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe
  "C:\Users\Admin\AppData\Local\Temp\3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a99B0.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe
      "C:\Users\Admin\AppData\Local\Temp\3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe"
      4⤵
      Executes dropped EXE
      PID:1928
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
c420c4af538b11e5654382b1b95c1f74

SHA1
b9c6a3a3f463948c25e162214d064039eb394b1b

SHA256
1605b0cd978c5eea742ac6c780774a1c921791a0b8efb5a4df0ef8243db956ce

SHA512
094687162f991b97ebc4a6b9f9bf0de05631ddde6fbec11595948c7c3ebdd1dd4e3d34bddd470beee8614d6c9533c394b4c700664ce0c41ee52df6e192bc1526

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a99B0.bat

Filesize
722B

MD5
83929e1da9f713171e0c92391d0c4893

SHA1
1841f0fd5a09f7acce1c1168bdb172e1e20c32f6

SHA256
0c13d8c9b310ad0fe6f2d440e96074f93bb2514a9a43d043e2fbc510c7ffd71a

SHA512
ae97db4723de21b6b1b98897bcb90e949da43375b7075219cb50166c35361a8112b08f543ab0dec41d6aedccc46e9eb30ce2d0476981d084a45df4ce93d75e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b3bfba83ec4d0950069e426a5887fcb5bd8e8b9a77f7a9e98de80b9aa993d94.exe.exe

Filesize
59KB

MD5
dfc18f7068913dde25742b856788d7ca

SHA1
cbaa23f782c2ddcd7c9ff024fd0b096952a2b387

SHA256
ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf

SHA512
d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
130284fd5a2812ba4fc96189d15de010

SHA1
1c255ac3be9f5f225f28bcb442cdf2227e6fe3f2

SHA256
367dfe4f3c4bf18252b62f54542ac6212d6785ffee9afef38dae660f9583fc4c

SHA512
e7c6c48e18481dec95c69319a1ccb9ca6aba0b6ec9eb137293844c5f60160e8b4a7bde69c027da14ce41acf489665446b19d0f0e52d315b58acb156891455f0e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1456-29-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2516-12-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2516-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2516-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-202-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-1853-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2920-3310-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download