cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
Size

1.2MB
MD5

c3e574773d5ebbbdb8f4fd661384e435
SHA1

ebf4ca50f1f852079d717db33713042744b8fe76
SHA256

cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488
SHA512

7fae8f480adb0feb6e2c31475e047953cfb8e134649773ff9d25998cbf2a413a5f11b4c8e008cdf2b728c470646395e26b1a81b32a1ae2a9015d9ce728b8d4ac
SSDEEP

24576:U71sQYmz7Gn/jWoHuUDCbmMqWfGL7SiwpCHr0H:U7Lzq/jWoOCUmMqWBvAq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2900	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	Logo1_.exe
2532	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Filters\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
File created	C:\Windows\Logo1_.exe	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe
2948	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2900	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	28
PID 1740 wrote to memory of 2900	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	28
PID 1740 wrote to memory of 2900	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	28
PID 1740 wrote to memory of 2900	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	28
PID 1740 wrote to memory of 2948	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	29
PID 1740 wrote to memory of 2948	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	29
PID 1740 wrote to memory of 2948	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	29
PID 1740 wrote to memory of 2948	1740	cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe	29
PID 2948 wrote to memory of 2616	2948	Logo1_.exe	31
PID 2948 wrote to memory of 2616	2948	Logo1_.exe	31
PID 2948 wrote to memory of 2616	2948	Logo1_.exe	31
PID 2948 wrote to memory of 2616	2948	Logo1_.exe	31
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2900 wrote to memory of 2532	2900	cmd.exe	33
PID 2616 wrote to memory of 2448	2616	net.exe	34
PID 2616 wrote to memory of 2448	2616	net.exe	34
PID 2616 wrote to memory of 2448	2616	net.exe	34
PID 2616 wrote to memory of 2448	2616	net.exe	34
PID 2948 wrote to memory of 1200	2948	Logo1_.exe	21
PID 2948 wrote to memory of 1200	2948	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
  "C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aEB.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
      "C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"
      4⤵
      Executes dropped EXE
      PID:2532
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
69e0ff51b5c71d80e8789788f4c0def5

SHA1
6a167207c2bcfc3af9a3db078cab336c23bff679

SHA256
0c795a07deb16a871947caa3fee6505f7645fb2df3b3f33b532b4dc9d4cbe077

SHA512
0c9ae6ef006ce63ab0d3d853ffbb8e5bb33bad1367863e07a0a92750d2282dda5f80590883964751260e727bc94f56198e0a24ceb81e689307dda15741d334fa

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aEB.bat

Filesize
720B

MD5
3ef1715c9fe6d9ff0c7d316f4950ba39

SHA1
503f8aca2e6bccee5b06bf972983282d3fa1ead9

SHA256
15152ba815e0cd4df438178d1ee84cb2272155e08e60f89b7ccd47cc2bce19a7

SHA512
639242ed3949e5aa22316901aee88a25d5b51690a336d8f3bcdbdd76e10f811943ddd521ebb7ce9b959bf1952222316f0cf410d00023f8b10518f97a421fe557

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe.exe

Filesize
1.2MB

MD5
4d0756eb75a5ea3416008e02ba104333

SHA1
45219ad56e5361a05fa73d29b75c668a3f00267b

SHA256
7cbffb7789087cfcd8dfc2c600cd10e758d5dd3b66e5f38b01f422a358c2a97c

SHA512
ac913eceb6e6f66d3827309ce89874365cf98e01f4bb56a83145c16867c388a8a9462bfd972302ee55af446fdb67955a5dba2bfbee1785f15cf2d5f3c6a7c56f

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
eae720ddb96259ba9cc84160c4e6db6b

SHA1
6e6aa6b84edda1752d2720be3269e5df9a7dbc91

SHA256
1e3b3150146e34c2742aa0816cab9a3720ecb9f8e6ad85db6db8624ca6a57760

SHA512
a386e5ebbe057131bfcbafcd14f2efe8cb486238394819e681feb1dc7fb5695df660cb2e6dc1ce3a944b1eabc365d91994ed1f137bde0a41d8a4c882428e7610

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini

Filesize
8B

MD5
4b4dbd7e2fe4189c8136069a10e1698a

SHA1
e4e6e1e80d1fe41d20456173c522d8e7affc4579

SHA256
f00f66ba8f3341c7ae8e3c7741a1ff31e522c75580afa9793dcaee17488ccf5b

SHA512
2be5b324ef5d951c5e66d692c26f813e0fdd76cb4ef01a9abf38e5f7837f649e0194f7f5c55b1cfd79a9d253031ace5b270fc50f6c11f1885e85f9a874380d8c

Download Submit
memory/1200-30-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/1740-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1740-16-0x0000000000220000-0x0000000000254000-memory.dmp

Filesize
208KB

Download
memory/1740-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-91-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-705-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-2452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-3310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download