8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe
Size

64KB
MD5

98b0064d89ed805f5157fc83cf9862bd
SHA1

8297a4debe0cb8cb739ad540be0853c1ff221ced
SHA256

8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c
SHA512

0ef6895b4d47af05e7e3fb28bd6a4332279996d02ddd93ed095c6cd3eafafffcd75076a5bb26c81dbf12749d632ce7086cfc661e0cb0f78d3adbefc98a738a65
SSDEEP

1536:13SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:1kF3pxrBkfkT5xHzD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1392	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1324	Logo1_.exe
2472	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe

Loads dropped DLL 1 IoCs

pid	Process
1392	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Download\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe
1324	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1392	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	28
PID 2812 wrote to memory of 1392	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	28
PID 2812 wrote to memory of 1392	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	28
PID 2812 wrote to memory of 1392	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	28
PID 2812 wrote to memory of 1324	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	30
PID 2812 wrote to memory of 1324	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	30
PID 2812 wrote to memory of 1324	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	30
PID 2812 wrote to memory of 1324	2812	8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe	30
PID 1392 wrote to memory of 2472	1392	cmd.exe	32
PID 1392 wrote to memory of 2472	1392	cmd.exe	32
PID 1392 wrote to memory of 2472	1392	cmd.exe	32
PID 1392 wrote to memory of 2472	1392	cmd.exe	32
PID 1324 wrote to memory of 3056	1324	Logo1_.exe	31
PID 1324 wrote to memory of 3056	1324	Logo1_.exe	31
PID 1324 wrote to memory of 3056	1324	Logo1_.exe	31
PID 1324 wrote to memory of 3056	1324	Logo1_.exe	31
PID 3056 wrote to memory of 2568	3056	net.exe	34
PID 3056 wrote to memory of 2568	3056	net.exe	34
PID 3056 wrote to memory of 2568	3056	net.exe	34
PID 3056 wrote to memory of 2568	3056	net.exe	34
PID 1324 wrote to memory of 1396	1324	Logo1_.exe	21
PID 1324 wrote to memory of 1396	1324	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396
- C:\Users\Admin\AppData\Local\Temp\8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe
  "C:\Users\Admin\AppData\Local\Temp\8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a841E.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe
      "C:\Users\Admin\AppData\Local\Temp\8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe"
      4⤵
      Executes dropped EXE
      PID:2472
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
252KB

MD5
e717ae96c8cbad47ef54a29cb03f56e2

SHA1
4580830b81aa06abec2d068c123fa50b8e9c9635

SHA256
d121a8c9c3190816787c202788ac001382accff0d958cc689076b5aaab77e763

SHA512
07f8a96c6553fb1667b6e6a285c6a879938143cd9345278209fba7998fccc4bed9e11d962105f011470fc06bf91e9e17df615ddd28af7b67d613a27c032a0be7

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
472KB

MD5
88eb1bca8c399bc3f46e99cdde2f047e

SHA1
55fafbceb011e1af2edced978686a90971bd95f2

SHA256
42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

SHA512
149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a841E.bat

Filesize
722B

MD5
41df2978ffe94acc2589e5cdebfb4f7f

SHA1
f9769f818b5630d42b4272b5b664fefdca9a6e4b

SHA256
4f26d24168af711173c646bb10b82c3c89f335e4b9714c60f2ee1f516024169b

SHA512
3f2caa750195e9651ce78f09d6a71f0b48f731ea32f1dcd67ab600107a475b1a9ec598a21a2b3211770f5887259e0ac8ba12ec10b842ca290b9bbb26269091c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8fa3daa625ae2dca89619f11c09a9e83ac60fce69a2456a0d077befa5f38806c.exe

Filesize
36KB

MD5
9f498971cbe636662f3d210747d619e1

SHA1
44b8e2732fa1e2f204fc70eaa1cb406616250085

SHA256
8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

SHA512
b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

Download Submit
C:\Windows\rundl132.exe

Filesize
27KB

MD5
1d88346ba33facab0ac50341f204c090

SHA1
51af8c88d05962fe058d04f4db2f91c149a8ca0e

SHA256
9f4b5fa6ae1fdbaa8ee45660ba2f7cb89fb4e2741aecb94905d3eebd4649d462

SHA512
33914c9a1a4618d3e26918a435a32767c0c9349044fdcca220fcd5c203d469da2537aa247a2ca011b5b7b7ef899304ee56eb8f5770c06e2b757f37f656c8fe6b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

Filesize
9B

MD5
fa1e1ef0fdda97877a13339b28fa95e5

SHA1
7e2cffca41118e7b2d62963bd940630b15b85653

SHA256
968b715c081472526487d60da8968e9b3bde2dac103f69beb3f6abe6ef7bc191

SHA512
3d55913a97aa89a7201342705640c1d031d19ad8aca4939219067f84e3fe118f47b4e388f490f69f605683d3854425c3de188f731886405474ae8e3d42c86f4f

Download Submit
memory/1324-18-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-38-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-90-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-162-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-1849-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1324-3309-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1396-29-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2812-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2812-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download