Analysis
- max time kernel
149s - max time network
120s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe
Resource
win7-20240419-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe
- Size 46KB
- Sample240603-w448eaef6v
- SHA256 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084
- MD5 58f24a6654c5b7bc13470f55fb478676
- SHA1 2bccb4243abdf329011097cbabea024d934e9738
- SHA512 af5b5c5b825e17cdf36645dbbbb9e573f699b778e1d4133d9a76d31e3ffab77367a30f2b871538ce86d1276c706d275cf826ca5849aaedd1778005ffefcbd20e
- SSDEEP 768:/6c1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL1nV9P8AGB2FZZfRDG74Uf2hLhM:tfgLdQAQfcfymNpV97Zfa4UfP
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2348 cmd.exe - Executes dropped EXE 2 IoCs
pid Process 2824 Logo1_.exe 2652 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe - Loads dropped DLL 1 IoCs
pid Process 2348 cmd.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe 2824 Logo1_.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2348 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 28 PID 1320 wrote to memory of 2348 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 28 PID 1320 wrote to memory of 2348 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 28 PID 1320 wrote to memory of 2348 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 28 PID 1320 wrote to memory of 2824 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 29 PID 1320 wrote to memory of 2824 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 29 PID 1320 wrote to memory of 2824 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 29 PID 1320 wrote to memory of 2824 1320 3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe 29 PID 2824 wrote to memory of 2696 2824 Logo1_.exe 31 PID 2824 wrote to memory of 2696 2824 Logo1_.exe 31 PID 2824 wrote to memory of 2696 2824 Logo1_.exe 31 PID 2824 wrote to memory of 2696 2824 Logo1_.exe 31 PID 2348 wrote to memory of 2652 2348 cmd.exe 33 PID 2348 wrote to memory of 2652 2348 cmd.exe 33 PID 2348 wrote to memory of 2652 2348 cmd.exe 33 PID 2348 wrote to memory of 2652 2348 cmd.exe 33 PID 2696 wrote to memory of 2636 2696 net.exe 34 PID 2696 wrote to memory of 2636 2696 net.exe 34 PID 2696 wrote to memory of 2636 2696 net.exe 34 PID 2696 wrote to memory of 2636 2696 net.exe 34 PID 2824 wrote to memory of 1196 2824 Logo1_.exe 21 PID 2824 wrote to memory of 1196 2824 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe"C:\Users\Admin\AppData\Local\Temp\3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1C18.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe"C:\Users\Admin\AppData\Local\Temp\3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe"4⤵
- Executes dropped EXE
PID:2652
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2636
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
- Size 251KB
- SHA256 8906bb45077aeebb6eaca93bccaa133623f3b5e9dcc0b50dc4c6edcc3ea1571a
- MD5 fa03025a5356ec12c1be2bf6f554120d
- SHA1 2bcdaa6bbce818a1d260c4293a07b5076a104e56
- SHA512 c78ac5d658231ba4dfb54941dfd3fb6e0752d6ec6215743679d1274bd16f5e283dca110f63db3955c23091d2de3f75c2fc5b6630e0be36ea37a16eb81b8716b0
- SSDEEP 6144:iVfjmNHgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:87+AitXqsTkiR7twRx+gD8PJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
- Size 471KB
- SHA256 30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
- MD5 4cfdb20b04aa239d6f9e83084d5d0a77
- SHA1 f22863e04cc1fd4435f785993ede165bd8245ac6
- SHA512 35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
- SSDEEP 12288:Pp7+kZc0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVzy:R7FMYenGJiKEbXWtfOkUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\$$a1C18.bat
- Size 722B
- SHA256 c4f755aa3cfea607a679e7f017b9d2abfed141d7c916ba648f97466c6c320b4c
- MD5 330db33d9a0cee28a858b4e897faf819
- SHA1 330f00a3ba24247bce6cd84a1490b72968c9d361
- SHA512 dc34d9c85f967c1110d9cf57c75403de84b143cbc75c90cb749371ca15015497f395c5e69a499180903e1ad25ffa7f574be8bd4171e1448a2cf8c735d9ae2822
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3468fe0c52f41fd7c6d21705ca782252ab2b23638baf0f9634b851912dbd3084.exe.exe
- Size 20KB
- SHA256 9ba18aa5e07ebd262d74412cca6e78bbd3c627d88f55555ad91e4038661f9fd1
- MD5 fd5810b26ebdf2dbe069d80da8fd516d
- SHA1 4bc0dd41a1ea87c34e5064bdaf28ab2ee063971a
- SHA512 4f36deee6cfd5411b57aa5496de4d11eed020470142dee1543aef61279f8b36fe97ec5074fa3c104d977f7402a3a89a0faabc8b6b4aa485890d8a45bcc1b11e4
- SSDEEP 384:Fjk+VCAP6UWrsGBlCBbF+UcefRDG7YuHgDgf2hLhM:FnV9P8AGB2FZZfRDG74Uf2hLhM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Logo1_.exe
- Size 26KB
- SHA256 bfe4186213f6d4cc116612e337bbe7a4c713d4cd02155dd649b31bf93476bd43
- MD5 4298e0c223e6572693e5a6b29279c1da
- SHA1 5bd4c027c9433de22fec622bb7b13b863cee8de4
- SHA512 d5df016ba3a3bcee7370ddd2aca1518fdde68dd681a17c45c8f7cf25a780be5903d49cf03410accfd8d176ce1653d9a49eb0544f5d0d1d091aa2d99fc8186ec1
- SSDEEP 768:/6c1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:tfgLdQAQfcfymN
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\_desktop.ini
- Size 8B
- SHA256 d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208
- MD5 a6f28952c332969f9e6d9f7d1a449737
- SHA1 31c0826adb63cc03162fb9e88781f4b50da8f11b
- SHA512 8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac
- MD5 SHA1 SHA512