Analysis
-
max time kernel
149s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
Resource
win10v2004-20240426-en
General
-
Target
04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe
-
Size
64KB
-
MD5
648d6dc6ebff924db713bc75e30249de
-
SHA1
875be1687f0280f9284c3fcd60c2a7be5d2692ef
-
SHA256
04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca
-
SHA512
3af59397a2e556ca08afd453a632e2cfea71210caa3c1cf65e2a6a8f898353de87afb9e4248b956cca6cc6b62bd94cba72d5c5e0a93bdc621ebf6524981c3eff
-
SSDEEP
1536:Kz3SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:akF3pxrBkfkT5xHzD
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2596 Logo1_.exe 4356 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\css\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\View3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe File created C:\Windows\Logo1_.exe 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe 2596 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1160 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 82 PID 2360 wrote to memory of 1160 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 82 PID 2360 wrote to memory of 1160 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 82 PID 2360 wrote to memory of 2596 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 83 PID 2360 wrote to memory of 2596 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 83 PID 2360 wrote to memory of 2596 2360 04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe 83 PID 2596 wrote to memory of 2076 2596 Logo1_.exe 84 PID 2596 wrote to memory of 2076 2596 Logo1_.exe 84 PID 2596 wrote to memory of 2076 2596 Logo1_.exe 84 PID 2076 wrote to memory of 3276 2076 net.exe 87 PID 2076 wrote to memory of 3276 2076 net.exe 87 PID 2076 wrote to memory of 3276 2076 net.exe 87 PID 1160 wrote to memory of 4356 1160 cmd.exe 88 PID 1160 wrote to memory of 4356 1160 cmd.exe 88 PID 2596 wrote to memory of 3536 2596 Logo1_.exe 56 PID 2596 wrote to memory of 3536 2596 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a325A.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe"4⤵
- Executes dropped EXE
PID:4356
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3276
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD56735a16d04dfac1f92f7ab89c64b071f
SHA1502eaa755229fc80b186faf533cf827c322bab66
SHA2563a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c
SHA512bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8
-
Filesize
571KB
MD5bab747a805ee67f925718f2624d54a11
SHA13f6fa0fe958f3a43e38c66014443e0c261f46bcc
SHA25603078980fff7ce8873b7e46fd8b79c2a86bb0354fc65268eac2aeff6d981e73e
SHA51265edbfebdfdf27c496f596bac45f63cd4834dbfb171bd2683a15a3d207b489ee65a045a0b78729005b457f551f128f444fba45baa63c8fe8748f422f48431c14
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize637KB
MD59cba1e86016b20490fff38fb45ff4963
SHA1378720d36869d50d06e9ffeef87488fbc2a8c8f7
SHA256a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19
SHA5122f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765
-
Filesize
722B
MD5413cdb88a1f093f464bbe09af1fa4743
SHA13bd7d598b6dc44768363e0d13ce48c3a971b3365
SHA25647b4796252f70fb4153bb74cb83e537a56f61d473c3e7aca4c2e9d7fc0500e4b
SHA51227053984f2d254d5b6a35fbb58916e30451c86c0446714f3c7044ef68ff8ead3c46d7f14f6f7d9bd443805643a72be4894feddadf22d4880af8ee924d2fb7fc7
-
C:\Users\Admin\AppData\Local\Temp\04053d4da072db95dc797eb41c7240e656692cdc67fe17510866c36bf5205aca.exe.exe
Filesize36KB
MD59f498971cbe636662f3d210747d619e1
SHA144b8e2732fa1e2f204fc70eaa1cb406616250085
SHA2568adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
SHA512b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
-
Filesize
27KB
MD52b90d375fad4e39663e1c00356e9206b
SHA15c84c40605f4af4185647e0a68aafed0ebbdc393
SHA256623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf
SHA5127c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f
-
Filesize
9B
MD57619ead719f9163af9f64f79eeff7c36
SHA17b956c82fba1f4a0ea8b09ca2e39d89159e21b75
SHA256da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45
SHA51229dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df