20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21

Analysis

max time kernel
152s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe
Size

1.0MB
MD5

072405dffbf781955823ee0a03f9780b
SHA1

d47b5c129e8366022b1ab467fd160ff6a2a1c075
SHA256

20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21
SHA512

5b27600cfd1ace8b99c56a0cfe461975d97132ae2a1f8db996c4e98db2eb91d77dced3bdf616af270bfd0e364120f401a9d1c82758595d463fb6cba66a58bbae
SSDEEP

24576:P7hLTATIZ0wktX0t8LCnhII+BKS5R2ZQCPnx2p:P7JmP/sSOQAx2

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2156	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1496	Logo1_.exe
1628	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe

Loads dropped DLL 2 IoCs

pid	Process
2156	cmd.exe
2156	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe
File created	C:\Windows\Logo1_.exe	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe
1496	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2156	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	28
PID 2872 wrote to memory of 2156	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	28
PID 2872 wrote to memory of 2156	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	28
PID 2872 wrote to memory of 2156	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	28
PID 2872 wrote to memory of 1496	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	30
PID 2872 wrote to memory of 1496	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	30
PID 2872 wrote to memory of 1496	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	30
PID 2872 wrote to memory of 1496	2872	20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe	30
PID 1496 wrote to memory of 2972	1496	Logo1_.exe	31
PID 1496 wrote to memory of 2972	1496	Logo1_.exe	31
PID 1496 wrote to memory of 2972	1496	Logo1_.exe	31
PID 1496 wrote to memory of 2972	1496	Logo1_.exe	31
PID 2156 wrote to memory of 1628	2156	cmd.exe	33
PID 2156 wrote to memory of 1628	2156	cmd.exe	33
PID 2156 wrote to memory of 1628	2156	cmd.exe	33
PID 2156 wrote to memory of 1628	2156	cmd.exe	33
PID 2972 wrote to memory of 2552	2972	net.exe	34
PID 2972 wrote to memory of 2552	2972	net.exe	34
PID 2972 wrote to memory of 2552	2972	net.exe	34
PID 2972 wrote to memory of 2552	2972	net.exe	34
PID 1496 wrote to memory of 1396	1496	Logo1_.exe	21
PID 1496 wrote to memory of 1396	1496	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396
- C:\Users\Admin\AppData\Local\Temp\20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe
  "C:\Users\Admin\AppData\Local\Temp\20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a52C2.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe
      "C:\Users\Admin\AppData\Local\Temp\20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe"
      4⤵
      Executes dropped EXE
      PID:1628
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
ea5cfbc75922a1e8469eac44237ed6a4

SHA1
5d8343b81425bc6338c5036bf6c458c9dc57b292

SHA256
e9dcf9faeaef5e223b05fcbe1c97f133dc7723591d911947b59dc88d5bdd3cca

SHA512
764fae1d5d17420640e73921cb916676ef6c628c4e7197c225fedd1e348458f967a87c6c5ab5fb9f4a320f9784efec7542088b730ace8f8ac60c41f47d91f66b

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a52C2.bat

Filesize
722B

MD5
48b0511577db70c8c6e74278c8ec2a0b

SHA1
f3642157f85779d1f15a9b70f987fe8fefc6fe8b

SHA256
b670e6ac724ef226936ce5522efa20735cadeed76edee47e31a2b92541c9b263

SHA512
19684e787196efd740b0e791f937a79d17ab91fa6976f2985317b037b4aca1a87653e907afa54abe82477023563c5cf3c13ea70f9e3504a3fbdb0b960b58531b

Download Submit
C:\Users\Admin\AppData\Local\Temp\20019f8c854d9b55c46ab224ffee2631d697ecd039f942750eed27a841236a21.exe.exe

Filesize
1.0MB

MD5
dff591c1405ed66adfcde6fe4b504e52

SHA1
e8b8823334c3e93be15ec50fc1b0a44e1f42d447

SHA256
242a70809bd63cd77fa69857ec5cd35bfa817c1e911d16213db9945c98d8ed9d

SHA512
5e5ccbc784bd6576998c05d16d18bb763f842a536983ee2d288b320ff10d50f7d0204b72e2975b1321f2dcdb4f0af7bee88fe304da7117ce87bde52ec3f5b934

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
542d91df1d3b6cf082f7417fa88b0479

SHA1
e4b2a944dd88696127389d1f4dfc70b2a41b38c7

SHA256
9a53a608fcc407f47345cede508ae5d15c598b62194f12e7eab72e5d3be71043

SHA512
ccb848910dfaee97260259609c4ebe75dd09ba27543eebb5132b46f3cb102b5f27279dbf083025b422c0a656005742362f45f84a11c74be32d93cfc1bbc8d24f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\_desktop.ini

Filesize
9B

MD5
72b7e38c6ba037d117f32b55c07b1a9c

SHA1
35e2435e512e17ca2be885e17d75913f06b90361

SHA256
e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

SHA512
2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

Download Submit
memory/1396-31-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1496-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-3324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-1862-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-750-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-50-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1628-34-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1628-43-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1628-29-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2872-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2872-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2872-20-0x00000000003A0000-0x00000000003D4000-memory.dmp

Filesize
208KB

Download