61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
Size

68KB
MD5

23f8010c15a4e25ee61c616bfd27b700
SHA1

dfee92c5b7bc4e3fafd36de439a88564a4df47a1
SHA256

61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4
SHA512

4507de6945e05ad1cc989f0917975ddb9d58a5d5c49469eb0a6e095caae8a8fca19bb8390b81f4a44395885f7e4831cf1c39f7519786e785886b84e9a3dbc8f5
SSDEEP

1536:Kz3SHmLKarIpYeEToa9D4ZQKbgZi1dst7x9PxQ:akF3pdlZQKbgZi1St7xQ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2032	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2916	Logo1_.exe
2160	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
File created	C:\Windows\Logo1_.exe	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe
2916	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2032	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	28
PID 1308 wrote to memory of 2032	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	28
PID 1308 wrote to memory of 2032	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	28
PID 1308 wrote to memory of 2032	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	28
PID 1308 wrote to memory of 2916	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	29
PID 1308 wrote to memory of 2916	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	29
PID 1308 wrote to memory of 2916	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	29
PID 1308 wrote to memory of 2916	1308	61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe	29
PID 2916 wrote to memory of 2696	2916	Logo1_.exe	31
PID 2916 wrote to memory of 2696	2916	Logo1_.exe	31
PID 2916 wrote to memory of 2696	2916	Logo1_.exe	31
PID 2916 wrote to memory of 2696	2916	Logo1_.exe	31
PID 2032 wrote to memory of 2160	2032	cmd.exe	33
PID 2032 wrote to memory of 2160	2032	cmd.exe	33
PID 2032 wrote to memory of 2160	2032	cmd.exe	33
PID 2032 wrote to memory of 2160	2032	cmd.exe	33
PID 2696 wrote to memory of 2540	2696	net.exe	34
PID 2696 wrote to memory of 2540	2696	net.exe	34
PID 2696 wrote to memory of 2540	2696	net.exe	34
PID 2696 wrote to memory of 2540	2696	net.exe	34
PID 2916 wrote to memory of 1200	2916	Logo1_.exe	21
PID 2916 wrote to memory of 1200	2916	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
  "C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a88A0.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe
      "C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe"
      4⤵
      Executes dropped EXE
      PID:2160
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
252KB

MD5
6735a16d04dfac1f92f7ab89c64b071f

SHA1
502eaa755229fc80b186faf533cf827c322bab66

SHA256
3a071105a38c10f7fa17dcc239337e999b57b68f4bd05c168b2548956931383c

SHA512
bfe01bb853f187f68d0fe64da2da4cf1d26c0491eb3183a7c7d5e905a1b1c3db90b84c1cdadb00c7d7f733ef32a9153dfa73de5259d9f1c3d401633145b420a8

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
472KB

MD5
88eb1bca8c399bc3f46e99cdde2f047e

SHA1
55fafbceb011e1af2edced978686a90971bd95f2

SHA256
42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

SHA512
149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a88A0.bat

Filesize
722B

MD5
520692304fe6234daba43e1197d3ae41

SHA1
096ce8b763a0606452ce4195843da54917613542

SHA256
fadfc422bd6452367ba5bfbf2c1d004a6e6c31a433eb18d2f3c464adb2d49b96

SHA512
02598e7cdecef887053b89cb7124974b97260f87b22a381b278f1c873c859bdbefb2266e5f3fb59cafc2fe969c725424d62060c06daadf0c802eab30c203f7cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\61aa87cf72e04e2782ec617fe213b8c7d7b39e6ebb1c881d51ce5cf4727f91d4.exe.exe

Filesize
41KB

MD5
977e405c109268909fd24a94cc23d4f0

SHA1
af5d032c2b6caa2164cf298e95b09060665c4188

SHA256
cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f

SHA512
12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5

Download Submit
C:\Windows\Logo1_.exe

Filesize
27KB

MD5
2b90d375fad4e39663e1c00356e9206b

SHA1
5c84c40605f4af4185647e0a68aafed0ebbdc393

SHA256
623973fd332abcafc9944af01d2fe114d0293a00cc29a67300cde94769b337cf

SHA512
7c9491cf52bdea6936bb7b2e30562941ca26a41587e5fdd05e02d17e37b773ebf0856092b3030ae31da2ce43196682e96873c0c9adfc8525903b11bf36e4806f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
7619ead719f9163af9f64f79eeff7c36

SHA1
7b956c82fba1f4a0ea8b09ca2e39d89159e21b75

SHA256
da9af76d7e3938d1bd300436de0d394ef0453f260a69c94905084222eb3fbb45

SHA512
29dd3ef54766931036c2f0d755bb3fc89619e548c95658577930a5a748ac2b2855a9e5ee5601697ebbac8a7d435abd4c9e9e2255b0e455e267e0d95358fa86df

Download Submit
memory/1200-30-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1308-18-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1308-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1308-17-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1308-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-39-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-45-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-91-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-97-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-1850-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-3310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2916-19-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download