24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe
Size

254KB
MD5

c651b93122afdbc14d0cc441a83583b3
SHA1

91220a64eac6a4f4e48fdef82f29260d76256f70
SHA256

24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189
SHA512

a671847159001e70aaaf659376ce42c7bec6151a141e448fcd5bf4cff06d9bfeb6aafbbf6eb7046d74e41f267395d5596a3731a4f05bc859f63d4519f7a78f13
SSDEEP

6144:h4uJQgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:h9itXqsTkiR7twRx+gD8PJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2348	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2356	Logo1_.exe
1972	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe

Loads dropped DLL 1 IoCs

pid	Process
2348	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\3082\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe
2356	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2348	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	30
PID 2044 wrote to memory of 2348	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	30
PID 2044 wrote to memory of 2348	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	30
PID 2044 wrote to memory of 2348	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	30
PID 2044 wrote to memory of 2356	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	31
PID 2044 wrote to memory of 2356	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	31
PID 2044 wrote to memory of 2356	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	31
PID 2044 wrote to memory of 2356	2044	24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe	31
PID 2356 wrote to memory of 1620	2356	Logo1_.exe	33
PID 2356 wrote to memory of 1620	2356	Logo1_.exe	33
PID 2356 wrote to memory of 1620	2356	Logo1_.exe	33
PID 2356 wrote to memory of 1620	2356	Logo1_.exe	33
PID 1620 wrote to memory of 1160	1620	net.exe	35
PID 1620 wrote to memory of 1160	1620	net.exe	35
PID 1620 wrote to memory of 1160	1620	net.exe	35
PID 1620 wrote to memory of 1160	1620	net.exe	35
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2348 wrote to memory of 1972	2348	cmd.exe	36
PID 2356 wrote to memory of 1212	2356	Logo1_.exe	21
PID 2356 wrote to memory of 1212	2356	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe
  "C:\Users\Admin\AppData\Local\Temp\24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a4F39.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe
      "C:\Users\Admin\AppData\Local\Temp\24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe"
      4⤵
      Executes dropped EXE
      PID:1972
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
e85807cbaf1c00d5c04e60d82117ed94

SHA1
2e586d30d725be909a6f4de38b582fc0bfe57c01

SHA256
eb0caf5692f857aadb09867f6526b1dd6f02c9980ccb8d7d58e09342c87fdda9

SHA512
af0d2fce26f6ddbf90d3a3359a9ac6740e4d9c830d65137914c3b85f68f9ae390f4454c90ed8fc5210a3c7ac45690d50690379996b5befa61a5853f93d041495

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a4F39.bat

Filesize
722B

MD5
f2548b7761218e652238821404bb22cb

SHA1
3c15b21ec7f858ed83c85a35ff2aa244e44a36dc

SHA256
e87d47a456a286a6469b5968c84f9c30bd8b3ae6a5d4da440452ebcb898e4f56

SHA512
0dc60d86efd4e63dcd32cab6afd4bc7afbd8d7f4a940be05a22501ca54d79c83fcf0f9057282d21a730ff9fecd8fc4392ed1d9d548bb4126fafbb128aa6099d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\24057cd6925e40e2097bfe7c8a4339d46f74820af4a3a21fadbfc515ecc2f189.exe.exe

Filesize
224KB

MD5
d4b257c01bbaa68d15d8368475a4e227

SHA1
fafae083a882e163cfa8c77258baaab891c17df2

SHA256
dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546

SHA512
167494ecb32196e8e199d7d14a1c0498eee45ab8e8862e5441539fa569313bb602b9e979935c7cc5ba39300e54e8bdbdf2f502e4ea24b5e8339fd2c3685ca502

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
60b10ffd5238bd8d922914d42a631817

SHA1
bbfd6002f993d9b4404ef9a7a5baee2383841ee2

SHA256
c866d8d9104db43afe18d75b22dda4f98648077bb4c92839428be0dc6d56ee98

SHA512
1ca0961cea7ea01448df9cb8f8e12bd9da6ac18cb361a404d4d81cbd21d62c81ebce6af6b41ba30b22eea289ddcafa1493b9e324ff16a7435aec8b0128e384fe

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
73b8aef84e892e3f77d41747dce253db

SHA1
d642a92c96e4ed570d998a73e42fc24fafe8caf9

SHA256
a81f7465f537233bbd4b8fa9034e52a8ceffcdf97bf36244c4d404ebec14eb24

SHA512
9b0690efee220355932375db333b5487c369ca9fdcf8497bcb5283d78d21fb4fefb7c06bbe533fb1f18fd3b32256a013090af6dd957b9d09cc373d0d5b89cf6d

Download Submit
memory/1212-29-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/2044-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2044-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-205-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-1849-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-3309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download