1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475

Analysis

max time kernel
149s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
Size

115KB
MD5

6b303388c32d448722310a1540de801c
SHA1

bcc7a993254b392d3aef34cec71f615f7de428b9
SHA256

1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475
SHA512

2b80868e0a27c75ecde6404e8f048560435424eddd745baf1f33240abd596ebe730408f478f3cb03674893cbcf0ee636ad7b0d78b4a9cd539f09d218fe1c2aa8
SSDEEP

1536:xjMqxL2Q3qOLjp01Y06JdOGZqlSmQBQ0H855ZXcWn/qsL1jTWBrt:xAyLd0K/JdOj0HmXcWn/qajKv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3496	Logo1_.exe
3764	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	Logo1_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe
3496	Logo1_.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3712	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	81
PID 3988 wrote to memory of 3712	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	81
PID 3988 wrote to memory of 3712	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	81
PID 3988 wrote to memory of 3496	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	82
PID 3988 wrote to memory of 3496	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	82
PID 3988 wrote to memory of 3496	3988	1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe	82
PID 3496 wrote to memory of 4816	3496	Logo1_.exe	84
PID 3496 wrote to memory of 4816	3496	Logo1_.exe	84
PID 3496 wrote to memory of 4816	3496	Logo1_.exe	84
PID 4816 wrote to memory of 1248	4816	net.exe	86
PID 4816 wrote to memory of 1248	4816	net.exe	86
PID 4816 wrote to memory of 1248	4816	net.exe	86
PID 3712 wrote to memory of 3764	3712	cmd.exe	87
PID 3712 wrote to memory of 3764	3712	cmd.exe	87
PID 3712 wrote to memory of 3764	3712	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
"C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42B6.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
    "C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe"
    3⤵
    - Executes dropped EXE
    PID:3764
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zG.exe

Filesize
750KB

MD5
c8684bbb2310ff4cf1c272f1995c71f3

SHA1
3a55943a3def1512b041484e9dda83dc2a782e3d

SHA256
bc4f6dca71769ff208a33b80e32625ea4ce7ea85c00d45f3dd4641f0edeb1986

SHA512
48f3c3231f879d212832682866a529b4bf69bddb14ecc95c80d77a6fadee0badbc9c2e16be4e3b4a4f36362202ada7448d9d98be803116091807d04b5b6aee18

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a42B6.bat

Filesize
722B

MD5
6a094617a176cd8648409db79c1a6e26

SHA1
e77b7ea67e60dbe989efed01fd06140c1749a77b

SHA256
d0b0c9bbb02eb565cb2b1763850ae312280675071fb5c1ca5bcff31dd0a2a63a

SHA512
65ab9a15f176941c71a532b715205b15756cfef097d50bdf672226755e451dc713886625a7ff41f05884efa484d0a9785fec17242ecbdec3971adc0b531cc71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe.exe

Filesize
49KB

MD5
33957dfa6df9e91ddbe5cdae1be4cece

SHA1
9047a25d9f5934c01100c18773c0b6362c1bad3f

SHA256
b72162e82cad37b09057721f9334a96e8efb9f3290619a83c66e69020591397d

SHA512
5bc056aac04c87a2973b34b8defe3747b947b6de35939b10c3dd19d32c8b15575d0d089050b2105672befbb92a9a775c4389972d794a8270b4c1c1801fe542ca

Download Submit
C:\Windows\Logo1_.exe

Filesize
66KB

MD5
9e55800e061b59df24521a41562b45e8

SHA1
66b0c3b70118debcbaa22fe6fb26e7b0f04d0110

SHA256
05e7905abaaab25a826c585f6682248ce8f02f5a572c869e248b3604daf7fc6b

SHA512
535b6f620688da3b27679453f04b7a5a57c924258cb382ae60838f1653f83214e0fcbb8c053632055068f747ae78c7a4b9aeb91ec2c37247b6a5d96424c25f65

Download Submit
memory/3496-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-142-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-208-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3496-220-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3764-11-0x0000000000780000-0x0000000000793000-memory.dmp

Filesize
76KB

Download
memory/3988-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download