Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 14:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe
-
Size
67KB
-
MD5
2ecc79afb43a544d6e8dd60a55cc78e3
-
SHA1
accc6a7da5f9af9f056766365f4c77b24e18ca99
-
SHA256
0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527
-
SHA512
6d18e47ce22de2aae5b43afca57923266de662bbe6eb8eacaee4ffa68a42fe148e7a43fa6a44366695972271af9430d2d01908a13e39beac4cce6c0c77089048
-
SSDEEP
768:ID1ODKAaDMG8H92RwZNQSw+IlJIJJREIOAEeF1afl0zGF7UvTHArFg2zN5d44ZO:IZfgLdQAQfhJIJ0IO61IFQGg2zt4
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3536 Logo1_.exe 2208 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\LoadedModelShaders\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe 3536 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3784 wrote to memory of 3120 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 84 PID 3784 wrote to memory of 3120 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 84 PID 3784 wrote to memory of 3120 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 84 PID 3784 wrote to memory of 3536 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 85 PID 3784 wrote to memory of 3536 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 85 PID 3784 wrote to memory of 3536 3784 0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe 85 PID 3536 wrote to memory of 1832 3536 Logo1_.exe 86 PID 3536 wrote to memory of 1832 3536 Logo1_.exe 86 PID 3536 wrote to memory of 1832 3536 Logo1_.exe 86 PID 1832 wrote to memory of 1932 1832 net.exe 89 PID 1832 wrote to memory of 1932 1832 net.exe 89 PID 1832 wrote to memory of 1932 1832 net.exe 89 PID 3120 wrote to memory of 2208 3120 cmd.exe 90 PID 3120 wrote to memory of 2208 3120 cmd.exe 90 PID 3120 wrote to memory of 2208 3120 cmd.exe 90 PID 3536 wrote to memory of 3448 3536 Logo1_.exe 57 PID 3536 wrote to memory of 3448 3536 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe"C:\Users\Admin\AppData\Local\Temp\0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A86.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe"C:\Users\Admin\AppData\Local\Temp\0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe"4⤵
- Executes dropped EXE
PID:2208
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1932
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD529a95e0568072695f5b30b0cbb9fe5d7
SHA19612403e6e8c729e82273e8d56c11763f7be4673
SHA2560677fc0ed20f72e55962077240d752810c3ffa5a8f8d276e4abc77d4cef31c35
SHA512fe28b8057d403dc6081f9c727f33e8675e8db62793b42d18f08c693f24d00e0f1d017337b97517d20f0e261b716f72eb720c8a15e1a3ddbff127e17d367442c5
-
Filesize
570KB
MD5c82d3751deff4dcbf3b202e148e69c9a
SHA15a22c3c0a4580c91966000b6d389c8d1106d5df1
SHA256b4a6116d5ea7e13dcee2fadf60927e49a93af8f5277ebcc3188fa2996e2325fd
SHA5129da860f2b4c90aadda5eef3943f55d556cb30704e0f88b4cf8499ecdc0af289e3d0aaaa75c288dcc6c75eec9884c6d9a58a9c151976308eb451f096c02735cd7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize636KB
MD5d82ffc872aed7c85cf936dcdcc2e6372
SHA150ca56cb4a429ce1532afaa2732f61833fc2b54f
SHA256a487733710d946abff1a93a23ae6bbafd6c0800bc78e4d5e3cac36e2a14ddace
SHA5120b0031418275c6be01f7757111058cd5bd3e5f4862e0631e2e28c5e7ffbb271446abdc2a88a7953ae55112799bc4a051becc2b14491e0d1760e336498665cc8b
-
Filesize
722B
MD5e6de2d79c8fc5f73afa4a00d99c7f7b4
SHA1b3746a2e099e8d8cd0e0414bea44fb8b9d00504b
SHA256927212fb08f09a6867ff5a84096b61656b73eb681f0f97fa2e32dc0e1496a286
SHA51274814b7cec1ea132db843a0a857f5a8a9e6878858ee052329ebb7b14a0a561409034192a715927f2e34cff1f6cb54b341a2ef85e419cd8b8d959500d51288d10
-
C:\Users\Admin\AppData\Local\Temp\0f77b210634c4cd2a42fe6086edfc850d6ea489ae3aa2b22191adbf29e8f9527.exe.exe
Filesize40KB
MD5ae6ae7519ae4cdb466127ba8ccd565c3
SHA18ab6f54478ff8a37961a666d6abe7e1e9d62dd77
SHA25663b2931842aafb63e40d9963835afbc5a7f1d005e75baa190827d3cc7ad8b5cc
SHA51267a3a903356008a84a464a2f1abaae4e335405e0e051f2db1ced6ddf186ff90ae86baf6b1318a0e1b9a3f9f4df1cd2118809630bc7712b35e2fce12913e903fd
-
Filesize
26KB
MD502513439d21e3e6a85ba70845b79380e
SHA16377c51d7d2310f217cf4c16400555aa3f47492a
SHA25604ab851dfbcbdc28bfb6b00e372ae20578e97f67d396057630fa4a76301df812
SHA512131b8683ae29daba7589b638a483df6a672ef6ea3010507beb639f1c58639324fff95fb4cca76c0ad825a53a8ab6bef789fda6b5f313238513ee0196e9ab6177
-
Filesize
9B
MD572b7e38c6ba037d117f32b55c07b1a9c
SHA135e2435e512e17ca2be885e17d75913f06b90361
SHA256e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6
SHA5122bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a