cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe
Size

88KB
MD5

210593a20d9a073d2970ca7ad0880d4e
SHA1

b2c43642549f7666f1afddfeb4a78961d5145213
SHA256

cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664
SHA512

aac56a1529b56fd1ce33ab27b97ad6c11f19867ae639b386d9869121f4827ab06345fd982c613bda11e5cea77440b43f1de22a8fc2cc94aff187ff541663d7eb
SSDEEP

1536:pR3SHuJV9Ntyapmebn4ddJZeY86iLflLJYEIs67rxo:pRkuJVL8LK4ddJMY86ipmns6S

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2264	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1808	Logo1_.exe
2692	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe
File created	C:\Windows\Logo1_.exe	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe
1808	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2264	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	28
PID 2236 wrote to memory of 2264	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	28
PID 2236 wrote to memory of 2264	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	28
PID 2236 wrote to memory of 2264	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	28
PID 2236 wrote to memory of 1808	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	30
PID 2236 wrote to memory of 1808	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	30
PID 2236 wrote to memory of 1808	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	30
PID 2236 wrote to memory of 1808	2236	cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe	30
PID 1808 wrote to memory of 2604	1808	Logo1_.exe	31
PID 1808 wrote to memory of 2604	1808	Logo1_.exe	31
PID 1808 wrote to memory of 2604	1808	Logo1_.exe	31
PID 1808 wrote to memory of 2604	1808	Logo1_.exe	31
PID 2264 wrote to memory of 2692	2264	cmd.exe	33
PID 2264 wrote to memory of 2692	2264	cmd.exe	33
PID 2264 wrote to memory of 2692	2264	cmd.exe	33
PID 2264 wrote to memory of 2692	2264	cmd.exe	33
PID 2604 wrote to memory of 2624	2604	net.exe	34
PID 2604 wrote to memory of 2624	2604	net.exe	34
PID 2604 wrote to memory of 2624	2604	net.exe	34
PID 2604 wrote to memory of 2624	2604	net.exe	34
PID 1808 wrote to memory of 1192	1808	Logo1_.exe	21
PID 1808 wrote to memory of 1192	1808	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe
  "C:\Users\Admin\AppData\Local\Temp\cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1FD0.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe
      "C:\Users\Admin\AppData\Local\Temp\cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe"
      4⤵
      Executes dropped EXE
      PID:2692
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
241414cd680074da4cdfc268a15625f0

SHA1
de1066ac065ff4771626f2f60bafbad706f075c8

SHA256
3d4634545b222a947a7f6b9d09126445b9a8537ad5cae12b3dc441f718a46c85

SHA512
84f68aaee1f7a11002cfbc659da32b81f365ed3df216270a5dee0e4606595948bf4b72f0626a773f2a32059111c04c0a77f46d3f732d5ae02874566fc0eda482

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
1ca79e3c2539763b0aaac5de49795afe

SHA1
2d240aef9a2cce22578f42ebecd3058e37a404a8

SHA256
e3e49eceb810b34fc826d70c6556d927a363f29c90b347ee4cfd61d7ba3ff2d9

SHA512
4e24d3ebcefa6545d85517bbc5bff3285f85a5967da1642a6e4e53bc2c41efc8b9092a3bbb56c1670b215d623ff5c320bcb06f654ac97482a5dff0da208349e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a1FD0.bat

Filesize
722B

MD5
4e35f4344d7da4c4bc87439a68cb217b

SHA1
b2eb441ff5620444bfd155eafe20294af7f942ad

SHA256
5cdafcadb6bb2c7efe0bb04da0f58894769e06a20af40391e4824bb45f1c7a6d

SHA512
2f6b40fec163e715bd6e59d4f01fe13a26d61ef38ba47841a1035275275ecabbfaa545e737a20feeccbb40e3373cb84528d5b15a1adea2ca2729684b0392b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc66df67b1f01797dca97cc461075e3b96f8c541dd6f2e0cbd4b24f0f2a1b664.exe

Filesize
59KB

MD5
dfc18f7068913dde25742b856788d7ca

SHA1
cbaa23f782c2ddcd7c9ff024fd0b096952a2b387

SHA256
ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf

SHA512
d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
8f31b087dee0080eff5bd98ab64c279f

SHA1
bd654b71a9c046caaeec82360c54b3dcf8f53f64

SHA256
004ac05c9561846720eb220b0be8409b8fe25a8bc792d5165f271b4ca7437363

SHA512
d6caa14c72b2aa7b3f9e3ac6fa129b1b37ad0e4a24ca3a66bbe11962f0241cab067db7548680e918381753ad0db1a5d91940630c93b3756275da110c1ea4913f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\_desktop.ini

Filesize
9B

MD5
4d28283e4d415600ffc2f8fda6d8c91e

SHA1
053dcb8d5d84b75459bc82d8740ee4684d680016

SHA256
b855effeaf01610130d3f38de35bc7f98bfc6643d98d4198af18534f048e8df7

SHA512
73a758cd5e5ac48d62dd89719be604214895e0cc9a10ff7464a6cf9161a37fd27d15dd2d2565f18198b381ac6442bcb36f38614df7b1176061a83616517a7edb

Download Submit
memory/1192-31-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/1808-832-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-46-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-3335-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-2722-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-1875-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2236-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2236-17-0x00000000003A0000-0x00000000003D6000-memory.dmp

Filesize
216KB

Download
memory/2236-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2236-15-0x00000000003A0000-0x00000000003D6000-memory.dmp

Filesize
216KB

Download