17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe
Size

66KB
MD5

82b2ebc252f414be8d418df9809332f9
SHA1

72e01a7ec9e561590caa7a51dd2f6c389f4226a0
SHA256

17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829
SHA512

4c000d47d5b8d35a973e5ee987bad657c7b4380c1cfb90df2f0dcae0bd030bfccc5608fed80fa7d62142c835142c753a9f7b51fe2c2dc876b7b0f6d70c5cac96
SSDEEP

1536:phF3SHuJV9NBriw+d9bHrkT5gUHz7FxtJ:phFkuJVLBrBkfkT5xHzD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2936	Logo1_.exe
2900	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe

Loads dropped DLL 1 IoCs

pid	Process
2456	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Install\{0CE5CC7E-EAA3-4562-A781-DCB0067BB36A}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe
File created	C:\Windows\Logo1_.exe	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2456	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	28
PID 1848 wrote to memory of 2456	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	28
PID 1848 wrote to memory of 2456	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	28
PID 1848 wrote to memory of 2456	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	28
PID 1848 wrote to memory of 2936	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	29
PID 1848 wrote to memory of 2936	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	29
PID 1848 wrote to memory of 2936	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	29
PID 1848 wrote to memory of 2936	1848	17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe	29
PID 2936 wrote to memory of 2632	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2632	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2632	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2632	2936	Logo1_.exe	31
PID 2632 wrote to memory of 2588	2632	net.exe	33
PID 2632 wrote to memory of 2588	2632	net.exe	33
PID 2632 wrote to memory of 2588	2632	net.exe	33
PID 2632 wrote to memory of 2588	2632	net.exe	33
PID 2456 wrote to memory of 2900	2456	cmd.exe	34
PID 2456 wrote to memory of 2900	2456	cmd.exe	34
PID 2456 wrote to memory of 2900	2456	cmd.exe	34
PID 2456 wrote to memory of 2900	2456	cmd.exe	34
PID 2936 wrote to memory of 1192	2936	Logo1_.exe	21
PID 2936 wrote to memory of 1192	2936	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe
  "C:\Users\Admin\AppData\Local\Temp\17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2166.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe
      "C:\Users\Admin\AppData\Local\Temp\17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe"
      4⤵
      Executes dropped EXE
      PID:2900
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
6eabc463f8025a7e6e65f38cba22f126

SHA1
3e430ee5ec01c5509ed750b88d3473e7990dfe95

SHA256
cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7

SHA512
c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2166.bat

Filesize
722B

MD5
d0471e1ed6ee7f67f9b6717d06e11649

SHA1
adf26b1e6be8258c279c531041992027dc3a2210

SHA256
6710654f8f8f7f3eb86f3f4a52a5e230b09a626055038f44c1d7513663107075

SHA512
283a49313214b2c3f955967f173ab4fef3e4cc4fa92ac9a1e4bc6974a676a58715868da3b29affa296d2d9599837e196711805642beee54217e9275fab13fcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\17f0c6d5fcd464da9ee6fb31d3d978dacd88d1ad2d4d13aa4ebb3e5a12847829.exe.exe

Filesize
36KB

MD5
9f498971cbe636662f3d210747d619e1

SHA1
44b8e2732fa1e2f204fc70eaa1cb406616250085

SHA256
8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

SHA512
b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
2cf2adc6226e2d29e19e7efba93c16b4

SHA1
bd8d009bd5a040e97d783c240b8335aa6498d17b

SHA256
53e4e6f91c4c650f77c61289d049b058da32b4668042adca7e1f280a830bdf26

SHA512
55917921f4311ae6d386f1e857f849e6c754a051e61282f03e20d23b1bfe5d16fb87934c81882b5d2bb3e30a105a8aa5284d247ca23129a6aebcb6f2bf854cb4

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.ini

Filesize
9B

MD5
7d02194d5f21d1288ee3e3f595122aba

SHA1
68e51fcc75148bf51da5ad67c7137b85946fc393

SHA256
a4da2cd5e1bd5b7cc915b0572d2805cb074c16122fa7e5a41fbc1203aafc3416

SHA512
b5aba933dbbe76d9c49da7e4bd9aa8449f164d1a6563feb65e795fd497f42a5c8cc317186adf817990a180e46499987a7403b68b0b089a38ccda0fc9f2dd6c1c

Download Submit
memory/1192-29-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1848-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1848-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-1022-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-3246-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2936-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download