Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe
Resource
win10v2004-20240426-en
General
-
Target
725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe
-
Size
5.7MB
-
MD5
ec534b18b77be3f61296098eeeb5c518
-
SHA1
3819b1709e3887bc6afc5f2d9163ea54ec651d23
-
SHA256
725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb
-
SHA512
8737da60ffa15e30c0757f2e234822c88b1eff11b15e0923bf50e41b9d87a94a0cb9c8ba9af73323609ea4ca3d62a304e7fa09e8dcf2b4e8b1ac0fd606d18931
-
SSDEEP
49152:zPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:bKUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2468 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1208 Logo1_.exe 2676 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe -
Loads dropped DLL 1 IoCs
pid Process 2468 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe File created C:\Windows\Logo1_.exe 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2468 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 28 PID 2040 wrote to memory of 2468 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 28 PID 2040 wrote to memory of 2468 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 28 PID 2040 wrote to memory of 2468 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 28 PID 2040 wrote to memory of 1208 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 29 PID 2040 wrote to memory of 1208 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 29 PID 2040 wrote to memory of 1208 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 29 PID 2040 wrote to memory of 1208 2040 725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe 29 PID 1208 wrote to memory of 2668 1208 Logo1_.exe 31 PID 1208 wrote to memory of 2668 1208 Logo1_.exe 31 PID 1208 wrote to memory of 2668 1208 Logo1_.exe 31 PID 1208 wrote to memory of 2668 1208 Logo1_.exe 31 PID 2668 wrote to memory of 1324 2668 net.exe 34 PID 2668 wrote to memory of 1324 2668 net.exe 34 PID 2668 wrote to memory of 1324 2668 net.exe 34 PID 2668 wrote to memory of 1324 2668 net.exe 34 PID 1208 wrote to memory of 1220 1208 Logo1_.exe 21 PID 1208 wrote to memory of 1220 1208 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe"C:\Users\Admin\AppData\Local\Temp\725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a39D5.bat3⤵
- Deletes itself
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe"C:\Users\Admin\AppData\Local\Temp\725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe"4⤵
- Executes dropped EXE
PID:2676
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1324
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5d86e00fdec23784005bc452f437fedb8
SHA15c8d5c4952600659f2177262c2b0554e5dcebd64
SHA256aa56ba1e1b10017ed23bccf1d5ba69dede6dc8dfa40ea585bce45dfd8ae3f0c3
SHA512648667cbdbf62b8ca75fc0091f9313a0a0d76bb2b2f3c1db4464bb8f3299562bcd247a7443dc55af7a05090a6e3acc98d8af10fd33ffad543f841152a1ccef77
-
Filesize
474KB
MD5999390d1a073d9d30149bfd4832f8783
SHA123e02a9b82087dc821baf05fe75ce2b81c62d05e
SHA2564c78f9b1285631d761c8005fefa2a29d047f08edd4a8c39c402e351002fc7cb5
SHA51222fe988e5b37e9a1a385bb972f53316141faa3266347e1d2142fe96725d40ee761c8fec13a4c20ada087607e1dc0f4375c329fe03b8c07af6c957a65eb5121bf
-
Filesize
722B
MD57697180881c0f5a2e423a7d0614fa825
SHA1f315f99a60d8dfeeee81909fc9f3a6777ad4843a
SHA256fc26b79cad1d0ef320b96a9fb091e15d1b16126383028f0f9404be6d1bbe9de7
SHA512a7e7e1733481539eb6260d54d689f36640f49a60d7bf6f1ae793fbb88bc3fb1744a861356d78efd5e7273a8947d204794bc0566e1c830606c07243e14238f956
-
C:\Users\Admin\AppData\Local\Temp\725a1c0a79b3b26672c06766ed0fb426a5a540123af9a13b5736316bdac240cb.exe.exe
Filesize5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
Filesize
29KB
MD54f5d22667d150fcb87a131ecf4f18373
SHA1ea6b17b4d068f007f17dcc1d2af587a5969ae213
SHA2568aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0
SHA512cbce12b897e11aab465fc244a7442f89ea5eac1a0e3bea595eae4951a454a51e065063a68771ee96588ed0b9674777f25776221bed1829075540541a9e28f6e1
-
Filesize
9B
MD54b2b75605a65a6762ec4715de0a70902
SHA13b85993ef06d2d814abc405188fdd19a1bffea0c
SHA25677072cc5a7b394508cf5d819ff8cf4385a9b3cb15d8715a59845ccfa235ea34e
SHA512888361e75afd4308bdad817af543704a42ffdf2d798acef619459e9978ac68f1cf4d468c6e0b146ab738b0109fdf331c4380471aa83f637b0f6ab06164840c65