0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
Size

926KB
MD5

1a3a325061c8d7bc7efc9e3709c0120d
SHA1

e9f0edf40d6ce7705c713e82e637816afcf46dce
SHA256

0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d
SHA512

5ed1f79609a72d970f273292c096f8c18c9051b228412b091caa5675f981256512bbc4138393c44716bf5dc575bbbfce4c6dec89ebddcb3a44945bde72724c9b
SSDEEP

12288:U7+lIzIM4/h0cRjG/kvMTheu8WDY3HlHgUoSPL/W/ZlW+V1jrpduBgVXceR5+n1p:U7sX/h0cEnh8WD8lHvWjW+DXp6rwPu9Z

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2008	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2228	Logo1_.exe
2144	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\az\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
File created	C:\Windows\Logo1_.exe	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe
2228	Logo1_.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2008	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	28
PID 1512 wrote to memory of 2008	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	28
PID 1512 wrote to memory of 2008	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	28
PID 1512 wrote to memory of 2008	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	28
PID 1512 wrote to memory of 2228	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	29
PID 1512 wrote to memory of 2228	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	29
PID 1512 wrote to memory of 2228	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	29
PID 1512 wrote to memory of 2228	1512	0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe	29
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2008 wrote to memory of 2144	2008	cmd.exe	32
PID 2228 wrote to memory of 2640	2228	Logo1_.exe	31
PID 2228 wrote to memory of 2640	2228	Logo1_.exe	31
PID 2228 wrote to memory of 2640	2228	Logo1_.exe	31
PID 2228 wrote to memory of 2640	2228	Logo1_.exe	31
PID 2640 wrote to memory of 2680	2640	net.exe	34
PID 2640 wrote to memory of 2680	2640	net.exe	34
PID 2640 wrote to memory of 2680	2640	net.exe	34
PID 2640 wrote to memory of 2680	2640	net.exe	34
PID 2228 wrote to memory of 1208	2228	Logo1_.exe	21
PID 2228 wrote to memory of 1208	2228	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
  "C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a11BC.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
      "C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"
      4⤵
      Executes dropped EXE
      PID:2144
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
69e0ff51b5c71d80e8789788f4c0def5

SHA1
6a167207c2bcfc3af9a3db078cab336c23bff679

SHA256
0c795a07deb16a871947caa3fee6505f7645fb2df3b3f33b532b4dc9d4cbe077

SHA512
0c9ae6ef006ce63ab0d3d853ffbb8e5bb33bad1367863e07a0a92750d2282dda5f80590883964751260e727bc94f56198e0a24ceb81e689307dda15741d334fa

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a11BC.bat

Filesize
722B

MD5
fd7afb754ba3914f8291627429e1de60

SHA1
c544f601c0f1e822c07fafdd4ef84a9b6934e76b

SHA256
e186ef62016db91df98e9f61fb106bec4b1c09df0ba8fa5a748fd6fabd88e8ef

SHA512
4f70276f17322498457c6e99c0e68669d340043fe7cd61a21666089c7ca6960644e34597994b634a695008592d278f6cdda350a5084f45c070406df0489564fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe.exe

Filesize
899KB

MD5
2cb5bc00421e0a0193169be2009d0022

SHA1
9a2754b0c2906dd64c1b2553246a232dc7c09bc1

SHA256
f5591ec5909f8cd792c709a3772bdd4441243e673b703c4395d5755dbb638c76

SHA512
35e1b408fe0c2f9b7dfc1e51ec9fe15029e53dd88a714e26c19f46711064e000f9bc44c1aef8adad3d647cd58bd5270202a2efd7f7fe30b6d1e1af028bae1cad

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
eae720ddb96259ba9cc84160c4e6db6b

SHA1
6e6aa6b84edda1752d2720be3269e5df9a7dbc91

SHA256
1e3b3150146e34c2742aa0816cab9a3720ecb9f8e6ad85db6db8624ca6a57760

SHA512
a386e5ebbe057131bfcbafcd14f2efe8cb486238394819e681feb1dc7fb5695df660cb2e6dc1ce3a944b1eabc365d91994ed1f137bde0a41d8a4c882428e7610

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini

Filesize
8B

MD5
d970a2bfcaa076939c06270d1a48dec8

SHA1
7a558f4d64c3e98bcfd2af83f28e6fbd207a39e1

SHA256
bdc6872f9a0a011a670907f0fedad9b88e283c5af545cf9f6bd73c3709967d44

SHA512
ea4c16930628455852ce343f8ae248b6df869b8da10b10928ebb802129f73d9761971811de317c7d3121b815340027782ec15d385d1d2d7df8fd0a46b62974c2

Download Submit
memory/1208-29-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/1512-12-0x00000000002B0000-0x00000000002E4000-memory.dmp

Filesize
208KB

Download
memory/1512-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-628-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-1850-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-2338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-3310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download