deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8

General

Target

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
Size

1.6MB
MD5

15fdfb61c3bcf26af3548d7fade4a8ae
SHA1

d76af19cc583ea66d0caa943a9593761c19dd020
SHA256

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8
SHA512

ef7c675344345e9a9d354c583d29b589571a2b892fe03f2d620f04fe955a82d838a611aef44fed844ad66be916c95b784b754f3eeec693a7ffaaa02e8095d956
SSDEEP

24576:77Fy4FMmZg15PgU+/uka4YjCp/SKhdm87PUY9Zbvhjdqdb3rWBvO0yjm0cg78:7737Rp/7dmGN9tJjdqRrwvol78

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exedeca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

pid process

1344 Logo1_.exe
616 deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

description ioc process

File opened for modification \??\PhysicalDrive0 deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\jscripts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

Logo1_.exedeca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

description	ioc	process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
File created	C:\Windows\Logo1_.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Logo1_.exe

pid	process
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe
1344	Logo1_.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exeLogo1_.exenet.execmd.exe

description	pid	process	target process
PID 2876 wrote to memory of 4776	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2876 wrote to memory of 4776	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2876 wrote to memory of 4776	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	cmd.exe
PID 2876 wrote to memory of 1344	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2876 wrote to memory of 1344	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 2876 wrote to memory of 1344	2876	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe	Logo1_.exe
PID 1344 wrote to memory of 1096	1344	Logo1_.exe	net.exe
PID 1344 wrote to memory of 1096	1344	Logo1_.exe	net.exe
PID 1344 wrote to memory of 1096	1344	Logo1_.exe	net.exe
PID 1096 wrote to memory of 740	1096	net.exe	net1.exe
PID 1096 wrote to memory of 740	1096	net.exe	net1.exe
PID 1096 wrote to memory of 740	1096	net.exe	net1.exe
PID 4776 wrote to memory of 616	4776	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 4776 wrote to memory of 616	4776	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 4776 wrote to memory of 616	4776	cmd.exe	deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
PID 1344 wrote to memory of 3428	1344	Logo1_.exe	Explorer.EXE
PID 1344 wrote to memory of 3428	1344	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
  "C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4006.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe
      "C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      PID:616
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
3d1572bb8bd0f47c8bae09ad1cd6d327

SHA1
1200b1b3f2404dcef74dfcf8affde5b605bc9114

SHA256
60aa8a96919888258a3b10447d91f4f83993e7fefbf9c7e32b21124c1cdfd262

SHA512
d7b7b18682e5f58e72b9d3a27c2d334c3db00e44a6b1faf1a765390356e8b20e69e4189e95487e56c3aca2710d761fecc069d764e73b64ea4ae6229f3460f9b0

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
570KB

MD5
de9e360e0645c5ca6fcadc535349fd0a

SHA1
5c6708b6fbcb5b77b151caa0f019bfd6059daf39

SHA256
44e4bb89ae548437dc66df1372b524c43c847e040cbdc3f29a74b6e503808aac

SHA512
58a32506954131637da992fac681a673273ebb006cbc6a2f902c5363a04c5e37c05ef46051646a14dbce42b0ba00b98cd2a9c6a8c25109b721aab15b785a84ba

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
636KB

MD5
2500f702e2b9632127c14e4eaae5d424

SHA1
8726fef12958265214eeb58001c995629834b13a

SHA256
82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

SHA512
f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a4006.bat

Filesize
722B

MD5
a8e7458616ad1354b354cbe060c16b3d

SHA1
beebee3e2567434b65a197271f9e6c19a2016f34

SHA256
efb506ceaa1e56e44322c07b307ffa016170226ab308b8aba9101a10c0352a15

SHA512
22dd5af0e35b37a96411d805c04ebad143e8f79048977b61fb9637dd424f0c9ea5085a922297c745e55db651635805d3a711aeda3beed705ece27e1d3ef1e519

Download Submit
C:\Users\Admin\AppData\Local\Temp\deca524c9b3b388167ce7b12fd731f456c8164621cb447133134ad4d1b8d64b8.exe.exe

Filesize
1.6MB

MD5
fd3162b9c1bd31c14851d3baf1055a90

SHA1
efe65a5df571257e15186ea339769cb61a98e2c3

SHA256
7fae64292d2c11b04a990140ab7b12f5a37eb74998c16a174ec13339783893b8

SHA512
d64efd63595fff017e3e90d1eb1203c28a4131444a71d7111efb2ec7761578f498da31409f5aa57a47c118c6727fab18371e4687d651b26847e543c478b83636

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
0a9fcb5422705ccc52b97a0f291ad9bc

SHA1
1464f8724a42524e5dc47483eb6288e9c34fec22

SHA256
85272876bcd6492a6bb54bfc95d2c4dc6d8cbee27dc11f7a60cad6620954a933

SHA512
f719785fecf4087ebd2ca0ff8ade00136472ab2b41dedcf3a9ecbb902f669c7449b395d0c92a9c2e6514dc48447c9eafaa54baf667f0050c42d212a08e632c3b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini

Filesize
9B

MD5
a470ca2426c102d035971b2e504d921b

SHA1
1720ef61e5c8e2ad6da9992a78940228fc81d615

SHA256
13721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5

SHA512
c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831

Download Submit
memory/1344-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-37-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-1231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-4797-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1344-5236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads