863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe
Size

27KB
MD5

0ef8be9c4880f1bcbb844f5b70c8b016
SHA1

e86003f9fd1aba6a476a7d9aa3123d9d889b62b1
SHA256

863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045
SHA512

96808066e59b5cf23fe96542032236b341830947dd5046ab487432059a88fbac8f5e745eb45d9018a21eeb21330c557602e6ecae5da93f53ec154805dd526c84
SSDEEP

768:pm31ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:pmlfgLdQAQfcfymN

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2948	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2116	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe
File created	C:\Windows\Logo1_.exe	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe
2116	Logo1_.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2948	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	28
PID 2204 wrote to memory of 2948	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	28
PID 2204 wrote to memory of 2948	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	28
PID 2204 wrote to memory of 2948	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	28
PID 2204 wrote to memory of 2116	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	29
PID 2204 wrote to memory of 2116	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	29
PID 2204 wrote to memory of 2116	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	29
PID 2204 wrote to memory of 2116	2204	863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe	29
PID 2116 wrote to memory of 2672	2116	Logo1_.exe	30
PID 2116 wrote to memory of 2672	2116	Logo1_.exe	30
PID 2116 wrote to memory of 2672	2116	Logo1_.exe	30
PID 2116 wrote to memory of 2672	2116	Logo1_.exe	30
PID 2672 wrote to memory of 2688	2672	net.exe	33
PID 2672 wrote to memory of 2688	2672	net.exe	33
PID 2672 wrote to memory of 2688	2672	net.exe	33
PID 2672 wrote to memory of 2688	2672	net.exe	33
PID 2116 wrote to memory of 1200	2116	Logo1_.exe	21
PID 2116 wrote to memory of 1200	2116	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe
  "C:\Users\Admin\AppData\Local\Temp\863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a20.bat
    3⤵
    - Deletes itself
    PID:2948
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
9ab1db7dabb16cd716c50906ab861f9b

SHA1
013b7ccc09009a77cc61a72f5aa1f386cbff4aab

SHA256
4f49c9c5948d2594c93a203c9f8cd3953b48b23579b72937222840ac71d027b6

SHA512
72d45e988e6410b467aa65d4dff4f335221303e11e6db123c10bed962a2bd159be21861f89b159f2fd4da147f9ca25bd9116876553082386e23b82dc20838a52

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
a373a8be1ec81f756766fd14b3cb1843

SHA1
a983ad3b441e2f54288c8d5072827553060ce489

SHA256
d161e11512f4ef6f84d1a09e742ebd623a5c6b2cf3135bb1e1015e320fbd1bff

SHA512
e661f7fa5373eb5cf879a615260339ce8fc29bdf950aa8127814cb14e1e03cd55184451a894dbb098ef377816aa1a0c50711af1d4e1cae5804fed3abfc9cff94

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a20.bat

Filesize
720B

MD5
9cba5b96946ddf0065f6a8bfd16ff108

SHA1
5c8242cd9f658de854a02354f76eb0217f0add42

SHA256
7fb437186189e7b8e8ca1237f539480923e0c57104688b847614fdeb71d1734a

SHA512
f9867cb9b775e9f3d7220026bd1b731004dc90402838974af65e2d6325f54594d7ee7ffc6b9d961db58cfce804a38b4d2e19095eefca9c96384b6c58d8a4da2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\863540861260956ec6b96769a7acf854d4242caa70220b3175365d8ed22d7045.exe.exe

Filesize
544B

MD5
e8956547dc8a032556475e5922508574

SHA1
f4739558e6f237918b333916c1c89981c10b8c8e

SHA256
f87a2969d8835244f6c007e7f4405abf127c142da4dc71a8fd2b426a2728bb95

SHA512
a9b6ddd028148ab588c54d4eb9abc18f6cbfc0c9813a6fddc68368005afd687f006c2a6645865a5e16af82b4976c456b2593eb35967ae07583cf4e57607e694e

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
4ce72835d52440e39f0547c5de7bd69a

SHA1
35f77a5e5c0be7d3b58cd78fe5194d417e72f8c1

SHA256
61154b48d22a8f73d2f6ec32b00fe898068c85bd27dd6b5ed28f7c887842d651

SHA512
3a5dc4ec443c84f81b6b22dae04b0bcaad3f7d04ee718ee41b150b5476190803cc21831e63e3dc61447f3d070109600e1a72508090049f2d35f9abd54ada5fd0

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1200-27-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/2116-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-94-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-725-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-1847-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-2440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-3307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-16-0x0000000000330000-0x0000000000364000-memory.dmp

Filesize
208KB

Download