Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe
Resource
win10v2004-20240226-en
General
-
Target
b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe
-
Size
100KB
-
MD5
50458e0e3de0cd602647b63607892642
-
SHA1
c5f443fd65e717ecee1af1f2148be813283c299d
-
SHA256
b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693
-
SHA512
8a3055fcaa672def4b1efd38b9bedff8f3ef639a3fc6c113a4d793cfa5169ddcd4d6c1c8b9cec5160ea5eb5f0d18e861c8915cef801075074a9632989c7fd371
-
SSDEEP
768:Uf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLHxurmSoqCzX3zIp8J80CpxuUe0Cp:UNfgLdQAQfcfymNnLzkTEuL7lfT9S
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2636 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2800 Logo1_.exe 2116 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe -
Loads dropped DLL 2 IoCs
pid Process 2636 cmd.exe 2636 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe File created C:\Windows\Logo1_.exe b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe 2800 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2636 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 28 PID 2244 wrote to memory of 2636 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 28 PID 2244 wrote to memory of 2636 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 28 PID 2244 wrote to memory of 2636 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 28 PID 2244 wrote to memory of 2800 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 29 PID 2244 wrote to memory of 2800 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 29 PID 2244 wrote to memory of 2800 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 29 PID 2244 wrote to memory of 2800 2244 b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe 29 PID 2800 wrote to memory of 2524 2800 Logo1_.exe 30 PID 2800 wrote to memory of 2524 2800 Logo1_.exe 30 PID 2800 wrote to memory of 2524 2800 Logo1_.exe 30 PID 2800 wrote to memory of 2524 2800 Logo1_.exe 30 PID 2636 wrote to memory of 2116 2636 cmd.exe 33 PID 2636 wrote to memory of 2116 2636 cmd.exe 33 PID 2636 wrote to memory of 2116 2636 cmd.exe 33 PID 2636 wrote to memory of 2116 2636 cmd.exe 33 PID 2524 wrote to memory of 2112 2524 net.exe 34 PID 2524 wrote to memory of 2112 2524 net.exe 34 PID 2524 wrote to memory of 2112 2524 net.exe 34 PID 2524 wrote to memory of 2112 2524 net.exe 34 PID 2800 wrote to memory of 1192 2800 Logo1_.exe 21 PID 2800 wrote to memory of 1192 2800 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aA035.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe"4⤵
- Executes dropped EXE
PID:2116
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2112
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD510e927db6aae50e89fcb4d441d9e27e1
SHA16a2250c03aba8fe7a9c388742db5ac4e473fa178
SHA256a68e60f5bc35fdb50525110f44ad636498278629d38a3854369e9a93ed70ee19
SHA5121d6c8b2d48403d037fc31ffeee690ca956ed8595671e1400c8dad69347ac0749d94498b00feec325575d98d300c0694d0083ca7e2e72a124ff45e9f74dd09227
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5d5bb01617a7058ad5ccf3ed5bd556979
SHA1938196286bc9287afb06317bf8db165303441ffe
SHA256cac2be80e8796c567eeb24afe9d27135a0e853efb2c9ff9981a5f6ceb36cc2c0
SHA512f2fd756be448e13ac117e5471667ecb099fe4440af69ec9910cb8b9a3571cf7d5275decaf186f90c87e20c8e380dace4cfc271a73a37f6d849ee960014906630
-
C:\Users\Admin\AppData\Local\Temp\b1639bc7a4813b7ba22c49c0050e93e7a1e25942f12a862c46c73bc99054e693.exe.exe
Filesize74KB
MD5545d1e26963a478eee9bb844caac1802
SHA1cfb64537a634a1f7111ab799c05a706a0869b55a
SHA256b88ea7dadb71946c6b5d9b6a2c6c974cd5b6a29408eb63bde7953713057f3f7d
SHA51245ce1c2a4be515e19633a704a8b92cc0756bf268e942b5d9e60ae1e0492bf82486af1c91162e1595b5a6742134a52e98012ab25d97216615b997121e30d20a74
-
Filesize
26KB
MD5e7093a12cfd837f03fc2aa86eaa886ba
SHA1bfeb2bd83d5d07adb9e0df6d23177660982f884d
SHA2569ce4f790a3ad9cb93ba0b875d0888db7e560fbbbceb022a1624252a26dde4db2
SHA5128ff9f31ff0e19431aec46a5ba04387ea145f42d4480911f5ea07deb9e8e48b6ce631d919746fa7446568a3a5e56c23a92f1e632379580cd286e7bdcc04350f55
-
Filesize
9B
MD5a470ca2426c102d035971b2e504d921b
SHA11720ef61e5c8e2ad6da9992a78940228fc81d615
SHA25613721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5
SHA512c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831