bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
Size

41KB
MD5

1913375580b62895ab8b610c734cc04c
SHA1

600fa438f355f803b13da1bb55066fea3c64f959
SHA256

bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92
SHA512

63fe4029d77bbcb7845dd6a4cb2c4ce5675512444722972bfe028edf4021ed75c728a15c077c8010d981bd7231d4f7a64cb17b7f0f2dc19bb8480b14a5cc3fb8
SSDEEP

768:sU16GVRu1yK9fMFLKaTxsujCT7pZpYIWQ3655Kv1X/qY1MSd:s+3SHmLKarIpYIHqaNrFd

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2320	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2272	Logo1_.exe
2628	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe
2272	Logo1_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2320	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	28
PID 2400 wrote to memory of 2320	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	28
PID 2400 wrote to memory of 2320	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	28
PID 2400 wrote to memory of 2320	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	28
PID 2400 wrote to memory of 2272	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	29
PID 2400 wrote to memory of 2272	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	29
PID 2400 wrote to memory of 2272	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	29
PID 2400 wrote to memory of 2272	2400	bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe	29
PID 2272 wrote to memory of 2896	2272	Logo1_.exe	31
PID 2272 wrote to memory of 2896	2272	Logo1_.exe	31
PID 2272 wrote to memory of 2896	2272	Logo1_.exe	31
PID 2272 wrote to memory of 2896	2272	Logo1_.exe	31
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2320 wrote to memory of 2628	2320	cmd.exe	32
PID 2896 wrote to memory of 1764	2896	net.exe	34
PID 2896 wrote to memory of 1764	2896	net.exe	34
PID 2896 wrote to memory of 1764	2896	net.exe	34
PID 2896 wrote to memory of 1764	2896	net.exe	34
PID 2272 wrote to memory of 1256	2272	Logo1_.exe	21
PID 2272 wrote to memory of 1256	2272	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
  "C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a232.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
      "C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      PID:2628
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
252KB

MD5
970c9faffeef4a686a5e8a308a4800c5

SHA1
88c9365a2bf84bb7ee7695bef211f26eaf61e154

SHA256
3ba0a07458d09c252ebe8d3ce4ee35c56605cda7e8a99cc07ea90caa334bf239

SHA512
20031aba5855426a24c218e7ec09214addb9a58376f3a200b7a9de619efba860e319066b2b7992f6cbab617fcf947f8c39549789402128792c25bda23fd97334

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
472KB

MD5
88eb1bca8c399bc3f46e99cdde2f047e

SHA1
55fafbceb011e1af2edced978686a90971bd95f2

SHA256
42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

SHA512
149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a232.bat

Filesize
721B

MD5
023c9b24c6a4692ca23d4d547928d7bc

SHA1
e2605adf1607e96cf7553028cdd342679e91e87a

SHA256
5918eecb1a5e3d9947ed179ff4173fc5173e3a7ff50e4c4ef2b07ed6350194cf

SHA512
52a37ba9b6959b21d22e07aa1fc82d960c15bcfd031cc16c3e8c8c974ab1c73b189110a22dfd4ce33873fcd35bf0204b56d21033b20fbfa7189a7cf90ab90c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe.exe

Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Windows\Logo1_.exe

Filesize
27KB

MD5
422eae1d27a7238ebf01a9a472b69126

SHA1
3db844e50f22bd66486eab06235effaeefc1ab5e

SHA256
02f4bf41aa6efbc2a49158fe1da4dbfadc09b0ff26e0c9553b593d527e771ed6

SHA512
36ce4fa5d259ba1e68dd097a154a6ba2bddf4ad37d563600eef0dfad80c08bd814720e29efd408c6ba2f0a87b28f8d275cc8b380295b93cf2affba4c905da526

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\_desktop.ini

Filesize
9B

MD5
a470ca2426c102d035971b2e504d921b

SHA1
1720ef61e5c8e2ad6da9992a78940228fc81d615

SHA256
13721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5

SHA512
c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831

Download Submit
memory/1256-29-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2272-90-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-18-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-38-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-507-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-1849-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-3309-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2400-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2400-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2400-16-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download