89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe
Size

565KB
MD5

f1973fc951f97973096fc9f5e2fc56a2
SHA1

b133bd551e3b526016c28c66fbac7a2d922b32ab
SHA256

89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab
SHA512

da586347fedb8f5b79af0dd32be0d6266100650125c42e103547c2f8119d2697225013528e4644868106e9b130804c58110a80a248d09afe1a6b74200c26309d
SSDEEP

12288:D8Gj11/IH1C2kp64AXhQJl2Nw+1ubLkgJ:D8GR1/gfkp64ARaT+IbLkgJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
320	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2500	Logo1_.exe
2124	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe

Loads dropped DLL 1 IoCs

pid	Process
320	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Install\{DACF1076-23BF-40CD-A7B7-7111819689FE}\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe
File created	C:\Windows\Logo1_.exe	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe
2500	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 320	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	28
PID 2312 wrote to memory of 320	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	28
PID 2312 wrote to memory of 320	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	28
PID 2312 wrote to memory of 320	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	28
PID 2312 wrote to memory of 2500	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	29
PID 2312 wrote to memory of 2500	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	29
PID 2312 wrote to memory of 2500	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	29
PID 2312 wrote to memory of 2500	2312	89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe	29
PID 2500 wrote to memory of 2668	2500	Logo1_.exe	31
PID 2500 wrote to memory of 2668	2500	Logo1_.exe	31
PID 2500 wrote to memory of 2668	2500	Logo1_.exe	31
PID 2500 wrote to memory of 2668	2500	Logo1_.exe	31
PID 2668 wrote to memory of 3000	2668	net.exe	33
PID 2668 wrote to memory of 3000	2668	net.exe	33
PID 2668 wrote to memory of 3000	2668	net.exe	33
PID 2668 wrote to memory of 3000	2668	net.exe	33
PID 320 wrote to memory of 2124	320	cmd.exe	34
PID 320 wrote to memory of 2124	320	cmd.exe	34
PID 320 wrote to memory of 2124	320	cmd.exe	34
PID 320 wrote to memory of 2124	320	cmd.exe	34
PID 2500 wrote to memory of 1272	2500	Logo1_.exe	21
PID 2500 wrote to memory of 1272	2500	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe
  "C:\Users\Admin\AppData\Local\Temp\89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe
      "C:\Users\Admin\AppData\Local\Temp\89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe"
      4⤵
      Executes dropped EXE
      PID:2124
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
bda8eee3b345c1f21b74cbd88cd64f64

SHA1
45bf87c341cc5801adb6be803f4c9b8fede6be01

SHA256
2dbcc6a6e407885c514d167b5853ac2bde21a05edeb0a1d44fffd9883ff415c3

SHA512
55064667b6a153874ecd5e32711acc38bb76466be4fa5a2d77907c976065ab06e8313a5accbe84aa7026a641b7b2bbbc784f1a67d7bc351941b28c8092692f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat

Filesize
722B

MD5
2ece1da092d3dd06898a2dba876748a7

SHA1
5f150671beb15ece5a19c2910136fb9185d0a883

SHA256
7d9d501cf933fccc1e6da89b036a4484ba9df98467b0c45d9ea94b1b53cd9f43

SHA512
1b908013dd7cce52a818dc2571e3d61d49cc0d207eb86878f2a9315adff26d6c83cb6be765c19c37aa6b438bcbd3be77af3971191e10936e20e80028ecf17e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\89e2acf38017617c1e9b2fe279bb64bb910ca0f04078770ae348f0806455bfab.exe.exe

Filesize
536KB

MD5
51f33fda33fec902d4a56ba6944c5ccb

SHA1
66b1397db173a38067769d95642ed80584a60834

SHA256
bef23bbb2608c9b994a1680e7b643117c60290f0fdd2bd96caf0cfcf82e37ed5

SHA512
2ae81bcfa74622f1eb91b013ea8094ea2309dc9508fc0e28bc95024ff6bb3560a4baf566b90206a1fb4891ad70f0eedb52dfbe10ffa8dbd5d2ea0c0d0c1469c1

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
c2714eeb0a075a663048727a1626345e

SHA1
78ac209416bd20b0c01049ffa07529d6eda0858b

SHA256
2d9faa2c88af94ed65a0c8dd8657af7f0c0fc3073c037094a36df8dc5b956f9d

SHA512
c4204f2a53da4f82270f92f1a6852ac32cca8b4ee8f4953639d4bddacaa7919734fc775bcdd07a8a0b518e4ac5cd9c9979edb2e889e61614782e7d9fef04f19e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1272-30-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2312-21-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2312-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2312-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2312-12-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2500-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-45-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-91-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-97-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-1850-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-2221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2500-2464-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download