beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b

Analysis

max time kernel
100s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe
Size

5.7MB
MD5

5b1240801cc4c10e0703fc4c055a53f0
SHA1

bc6ecdcc3bb18ffbd0c893245fcd27d47c17d3f4
SHA256

beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b
SHA512

ce2bc0e249701d19897d622b78f5345ded4504a194219252d9e9f2f364e474aba4845912902e70de9c4302d9553ff5413c97d0ec9f6d6efa8619301b91509cfd
SSDEEP

49152:WPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:IKUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3008	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2504	Logo1_.exe
2744	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe

Loads dropped DLL 1 IoCs

pid	Process
3008	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe
File created	C:\Windows\Logo1_.exe	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe
2504	Logo1_.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3008	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	28
PID 2728 wrote to memory of 3008	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	28
PID 2728 wrote to memory of 3008	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	28
PID 2728 wrote to memory of 3008	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	28
PID 2728 wrote to memory of 2504	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	29
PID 2728 wrote to memory of 2504	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	29
PID 2728 wrote to memory of 2504	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	29
PID 2728 wrote to memory of 2504	2728	beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe	29
PID 2504 wrote to memory of 2528	2504	Logo1_.exe	31
PID 2504 wrote to memory of 2528	2504	Logo1_.exe	31
PID 2504 wrote to memory of 2528	2504	Logo1_.exe	31
PID 2504 wrote to memory of 2528	2504	Logo1_.exe	31
PID 2528 wrote to memory of 2656	2528	net.exe	33
PID 2528 wrote to memory of 2656	2528	net.exe	33
PID 2528 wrote to memory of 2656	2528	net.exe	33
PID 2528 wrote to memory of 2656	2528	net.exe	33
PID 2504 wrote to memory of 1188	2504	Logo1_.exe	21
PID 2504 wrote to memory of 1188	2504	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe
  "C:\Users\Admin\AppData\Local\Temp\beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2E22.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe
      "C:\Users\Admin\AppData\Local\Temp\beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe"
      4⤵
      Executes dropped EXE
      PID:2744
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
9fff503fad7fa1d9cc7453fdf86ff0e0

SHA1
f9b728ba2e8bf2b3a570583f06b0fd7e9fce4ef2

SHA256
826148f8b31a5372a71adf8f51961e1b59de63c8865393feffb99ece5e113147

SHA512
c00773863ea4b6d88ba1c5a9dcfd2f1033e540c854f2f041bb193f367a9153d54d9fcec0c71e4e9834bbe98a6a5be030b045d34e3b54d69cddfd4d427895af4f

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
92KB

MD5
69d52019abaf47f4b6743c611f5d69a7

SHA1
84dc1120ef31ac4073ad2df0f422b0c9cdc95413

SHA256
77d8e9a06f152f8cb1a1e9d6d3b3b04908d81424fed1d44e0f2f51b59c1b4a37

SHA512
1648a31f3a2a2f51beb29e0745225ab532d9e6b68e63e22f00d6484191bbf0a63ab6a1744f3f0be335b4cc6da2d3936c7d9c153213d3660896fdf1760e65d78e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a2E22.bat

Filesize
722B

MD5
110c751df3ec69f76dcddcde5df8133c

SHA1
216055f6c4b2605330923ca4c2d05090af896fce

SHA256
1d434db532035b8abe4962ec9464c69a0f9e3773647f41fc03a5974fe6869949

SHA512
4b67a17722de5fdeba693ef134319eb715b9ae3a527ebbb9a61bcd2b45e58e6b29180e291843c1c5cfd7d97afb6a660191b9c799e21ff90daa576212f92967f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\beb6fd50549673627618d26ff3871eba2850fe2b6ce7bcdb9c6031f5e364567b.exe.exe

Filesize
5.7MB

MD5
ba18e99b3e17adb5b029eaebc457dd89

SHA1
ec0458f3c00d35b323f08d4e1cc2e72899429c38

SHA256
f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

SHA512
1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
2a84a41363c8f33192d48cfc5b1459b5

SHA1
6b4795876d91e6600070db0f75483a262ffb2f5b

SHA256
67c355070d3e00939065d2c9f0ecff9ebdaf89e4913f4584e8d576988b3b0866

SHA512
51eaa45d30d89b392c3ba6436b31424115d5cfd5d009a5ce5ed2a55eded885d7bd63e6236196dd7bcd2b8613d14a0b89ad6dfbad2aa25b1ced7d74ab3d905f44

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini

Filesize
9B

MD5
60b1ffe4d5892b7ae054738eec1fd425

SHA1
80d4e944617f4132b1c6917345b158f3693f35c8

SHA256
5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

SHA512
7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

Download Submit
memory/1188-29-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2504-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-46-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-829-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-1851-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-2736-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-3311-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2504-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2728-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2728-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download