e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Size

357KB
MD5

9dcffc4e8bea3bfda2154c1b6d6e13ea
SHA1

bd4f9e5aca1f4acca9bf8a0168a87f2c4c39035b
SHA256

e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750
SHA512

c3105b90a421933a6e0249d24ab75ab14e6f8c31b94169cdfd47baa088b16e90b75e87e7ebb0b784f44cb2133e918bc89b65455cc55ff242a0f07a270249ce2b
SSDEEP

6144:SVfjmNqck+UDJeMCZJPWZI2pxLRjA4ZD05WGNl6yZ:s7+q0oUJPWZ5pxC41G2e

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2984	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1248	Logo1_.exe
2920	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe

Loads dropped DLL 2 IoCs

pid	Process
2984	cmd.exe
2984	cmd.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DAO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
File created	C:\Windows\Logo1_.exe	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileType\{A324EA60-2156-11D0-826F-00A0C9044E61}\0	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileType\{A324EA60-2156-11D0-826F-00A0C9044E61}\0\ = "128,4,FFFFFFFF,50450000"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileType	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell\View Dependencies\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E13FC0~1.EXE /dde"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A324EA60-2156-11D0-826F-00A0C9044E61}\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sysfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drvfile\shell\View Dependencies\ddeexec	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\View Dependencies\command	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ocxfile\shell\View Dependencies\ddeexec\ = "[open(\"%1\")]"	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe
1248	Logo1_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2920	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
2920	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2984	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	28
PID 1912 wrote to memory of 2984	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	28
PID 1912 wrote to memory of 2984	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	28
PID 1912 wrote to memory of 2984	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	28
PID 1912 wrote to memory of 1248	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	30
PID 1912 wrote to memory of 1248	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	30
PID 1912 wrote to memory of 1248	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	30
PID 1912 wrote to memory of 1248	1912	e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe	30
PID 2984 wrote to memory of 2920	2984	cmd.exe	32
PID 2984 wrote to memory of 2920	2984	cmd.exe	32
PID 2984 wrote to memory of 2920	2984	cmd.exe	32
PID 2984 wrote to memory of 2920	2984	cmd.exe	32
PID 1248 wrote to memory of 2496	1248	Logo1_.exe	31
PID 1248 wrote to memory of 2496	1248	Logo1_.exe	31
PID 1248 wrote to memory of 2496	1248	Logo1_.exe	31
PID 1248 wrote to memory of 2496	1248	Logo1_.exe	31
PID 2496 wrote to memory of 2628	2496	net.exe	34
PID 2496 wrote to memory of 2628	2496	net.exe	34
PID 2496 wrote to memory of 2628	2496	net.exe	34
PID 2496 wrote to memory of 2628	2496	net.exe	34
PID 1248 wrote to memory of 1188	1248	Logo1_.exe	21
PID 1248 wrote to memory of 1188	1248	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
  "C:\Users\Admin\AppData\Local\Temp\e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aB66.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe
      "C:\Users\Admin\AppData\Local\Temp\e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe"
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2920
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
00a2d585a9ff022e46e78ed2cb47bc1c

SHA1
74cefbf5552ef15e079c2e77c420fc7012914fba

SHA256
54ad52f2f2f7c68bdd3597ed47643ea10d1c9b3584bcc4027e0d12905b2e7d49

SHA512
494f924eaedb9de485b84f3e9c805bbbde5d1921e6f7702cfdc05b3761bcd19395d9d4908e77efabd295983ac0ef9112de45c1b8aac909e8cf3d0c17144cc142

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aB66.bat

Filesize
721B

MD5
a33b2bcdc48e82f525354d1b1b8d9a95

SHA1
d17f5185d4b5dadf2716ab28ba33c43b60ee5bc8

SHA256
9c35b409f57f7eba28ce831e8c63c18de14c3fcd2b2dda7a3e85f24f79915227

SHA512
8299ef11b261b02718a789941406b2933289681e05b6389d62bb0577992877b74a122bfb8c98ca16499cf5ccba0b5300ccd3f119947b664cba2ffc962b5637e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e13fc027e6b4e67b76bb77a70da55425908bbb589aee14ee63763f084a731750.exe.exe

Filesize
331KB

MD5
298d2699634589bd40fa7a44806263ea

SHA1
530dbb1293d5d19d45b87c56be687d536f6a63ce

SHA256
bdeeea007b0c4798baffe265e0a9e2ec8e5e7a3a302ba27142cb7e8b1d7fb7c2

SHA512
0ce0b0b9f35268110f7623c68eacc64488795a70e92462a1b10e2d97d7840754a82fd8f44d5ab995330b061c05b21e742c8bc64f7843c37d63cd88ba397a6c28

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
0dea5c8d1652084c78d53e181c8caa76

SHA1
b8ad1aa5589174953c4409aaa41cbbb807a3fe0c

SHA256
62c076dbb90c93897710ee6a9548f97d3fb9e1ab2e5b0df2964a7fb32fae19a0

SHA512
96267e3286cfb25e71f356f8ddabc364d45e781d8ab5f46ebf5d1e3a0e8397cd54fb4b09d10195305677151fa81cdcaecb635ba416e7467e89698bd2d7ba930e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.ini

Filesize
9B

MD5
e7957b9f3d9556c996418169821a7993

SHA1
b7028de0f91d2e50a8d5f6d23613331a2784a142

SHA256
71a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539

SHA512
72bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285

Download Submit
memory/1188-32-0x0000000003D40000-0x0000000003D41000-memory.dmp

Filesize
4KB

Download
memory/1248-743-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-99-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-3312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-93-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-2875-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-1852-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-18-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/1912-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-12-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download