Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 18:29
Static task
static1
Behavioral task
behavioral1
Sample
4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
Resource
win10v2004-20240426-en
General
-
Target
4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe
-
Size
341KB
-
MD5
fb648981e436882a181ae1edf0f65e66
-
SHA1
7bed8cbe0589d99c1764c00906c75cd0e0c7113f
-
SHA256
4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50
-
SHA512
0da837f8d1a42e063da2b0054c3fd6937d4acbec62ae2e93970ac0341be09238eb20fc6d6ff127d43464e8d3f2d2fd42128dda8bbd510e32f569fec71d041c71
-
SSDEEP
6144:TVfjmN7juXfo9e3/QCeve3XoQupt55EhtcxtpiO11ivncfQivI5:p7+7jQJeve3Gpt55VR/onQQivI5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2360 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2380 Logo1_.exe 2804 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe -
Loads dropped DLL 6 IoCs
pid Process 2360 cmd.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\More Games\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe File created C:\Windows\Logo1_.exe 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe 2380 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2360 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 28 PID 2864 wrote to memory of 2360 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 28 PID 2864 wrote to memory of 2360 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 28 PID 2864 wrote to memory of 2360 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 28 PID 2864 wrote to memory of 2380 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 29 PID 2864 wrote to memory of 2380 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 29 PID 2864 wrote to memory of 2380 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 29 PID 2864 wrote to memory of 2380 2864 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 29 PID 2380 wrote to memory of 3032 2380 Logo1_.exe 31 PID 2380 wrote to memory of 3032 2380 Logo1_.exe 31 PID 2380 wrote to memory of 3032 2380 Logo1_.exe 31 PID 2380 wrote to memory of 3032 2380 Logo1_.exe 31 PID 2360 wrote to memory of 2804 2360 cmd.exe 33 PID 2360 wrote to memory of 2804 2360 cmd.exe 33 PID 2360 wrote to memory of 2804 2360 cmd.exe 33 PID 2360 wrote to memory of 2804 2360 cmd.exe 33 PID 3032 wrote to memory of 2676 3032 net.exe 34 PID 3032 wrote to memory of 2676 3032 net.exe 34 PID 3032 wrote to memory of 2676 3032 net.exe 34 PID 3032 wrote to memory of 2676 3032 net.exe 34 PID 2804 wrote to memory of 2692 2804 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 35 PID 2804 wrote to memory of 2692 2804 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 35 PID 2804 wrote to memory of 2692 2804 4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe 35 PID 2380 wrote to memory of 1176 2380 Logo1_.exe 21 PID 2380 wrote to memory of 1176 2380 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a6A5.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2804 -s 5125⤵
- Loads dropped DLL
PID:2692
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2676
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5ea3e7a80029fb4b8eaf381d61f94eb7e
SHA1542cffe191c68dba2679f9e167d3f1e2c96a06f3
SHA256f7d095c63ade32f4ba12501fb85ffb9f959d83c1e47076f2a05892339735715d
SHA5120ee9e7288ea1fb905f14cf4983f1f591409ec671bef6f45b134aea0bdd8b0ba62251c77aa401a049b172b269cb442aa21fd4ae66730d137609e95e580d6a52bd
-
Filesize
471KB
MD5c6c8fde27f649c91ddaab8cb9ca344a6
SHA15e4865aec432a18107182f47edda176e8c566152
SHA25632c3fed53bfc1d890e9bd1d771fdc7e2c81480e03f1425bce07b4045a192d100
SHA512a8df7d1e852d871d7f16bae10c4ff049359583da88cc85a039f0298525839040d5363ce5ef4cbdb92a12a25785f73df83cf0df07752b78e6e6444f32160a2155
-
Filesize
721B
MD5b361361dceea465090c64309a5c7a339
SHA1dd45e79e2ec39e4aea55cb933c50472094813453
SHA256d829799fc757408b315c8a9b60ddaf2cb564b273d92c0f5db18fbc7a2a5af4ab
SHA51229e69869cfdd300f4ff9914934810d21f8f4720e762ff1ce7f385eeb53903098028f1d1381a900eb001f9f52ba37d71cb9356b972be91e3afd51074d9b0e3ffc
-
C:\Users\Admin\AppData\Local\Temp\4b6b8f0ad937c6f74b9279788531bdbb92edb0565e49f7ce4e8b0431712dcc50.exe.exe
Filesize315KB
MD509ac2b6f268980a4d135fe651bbf3cbe
SHA1eee57f93ff5ca7b28046f55d668e357c12e63d85
SHA2564be96b9592273c3ab2ac051e088a68f13c0e8aa8217dd5e809763abd7db44618
SHA51209683bdb47fb2fe77c1b99ce7b850001b8771c968f2ef8d0fb354a27111c8294a164ac7a6912176913e15a15073aa95594c0c0da69cc43c7e1306b088370b2e2
-
Filesize
26KB
MD5feb8473549216daa0adec2e3945a3db8
SHA1a0366043f5537172b5cc605afe339c28dce37d16
SHA25623ffb3cc8727b16073e7944e36eabbf7b087f6923c78e88ed92c08b13af48671
SHA512090cbae5bd60f40cc983cd6abd52af8ac083705e80fd08e676c72feff826844785f4d2e76c2a40bd85df0097eac64d4bf9fe008108051c2218cccfb6abd50848
-
Filesize
8B
MD58de83b88f7ab26b8a33a1eeb970a7bc8
SHA1ad3208ec0bdfacd12ad7291d0259ef41b6bfc425
SHA256499baf65b91c9fff00cab334a4d8ab59d253993f173da5c33ff01ea4afc217fe
SHA5129272af088cc70ebeb388cefda678d35e649433d3a6c5715f3537e2832b3fead9568d58a026c36ab711fdef87597419e8be80a5d809530a933f72328c413a5d7e