68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe
Size

89KB
MD5

825542c22924ff45332ad53271d47a4d
SHA1

0c506cae9ee66b4e30d2a42fb3e8eca349d7d095
SHA256

68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c
SHA512

ae654550ddb8a0fc3e4fc922899a998d4a9d647b72deb0cd7e37cf890c590b5fb75cbc66d9e433841cbcd885a88e190f9ce462896d2facf412f40fd55c1d8048
SSDEEP

1536:tfgLdQAQfcfymNG+KxzFXc9CDn3/UPhLGxfk3YMKbNU29hrKkEC/RKD1:tftffjmNoxzFXBMPhLGx8ub+wEC/i

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2036	Logo1_.exe
2424	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe

Loads dropped DLL 6 IoCs

pid	Process
2692	cmd.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe
2452	WerFault.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Journal\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe
File created	C:\Windows\Logo1_.exe	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2424	WerFault.exe	33

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe
2036	Logo1_.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2692	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	28
PID 1656 wrote to memory of 2692	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	28
PID 1656 wrote to memory of 2692	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	28
PID 1656 wrote to memory of 2692	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	28
PID 1656 wrote to memory of 2036	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	30
PID 1656 wrote to memory of 2036	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	30
PID 1656 wrote to memory of 2036	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	30
PID 1656 wrote to memory of 2036	1656	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	30
PID 2036 wrote to memory of 2628	2036	Logo1_.exe	31
PID 2036 wrote to memory of 2628	2036	Logo1_.exe	31
PID 2036 wrote to memory of 2628	2036	Logo1_.exe	31
PID 2036 wrote to memory of 2628	2036	Logo1_.exe	31
PID 2692 wrote to memory of 2424	2692	cmd.exe	33
PID 2692 wrote to memory of 2424	2692	cmd.exe	33
PID 2692 wrote to memory of 2424	2692	cmd.exe	33
PID 2692 wrote to memory of 2424	2692	cmd.exe	33
PID 2628 wrote to memory of 2576	2628	net.exe	34
PID 2628 wrote to memory of 2576	2628	net.exe	34
PID 2628 wrote to memory of 2576	2628	net.exe	34
PID 2628 wrote to memory of 2576	2628	net.exe	34
PID 2424 wrote to memory of 2452	2424	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	35
PID 2424 wrote to memory of 2452	2424	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	35
PID 2424 wrote to memory of 2452	2424	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	35
PID 2424 wrote to memory of 2452	2424	68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe	35
PID 2036 wrote to memory of 1120	2036	Logo1_.exe	20
PID 2036 wrote to memory of 1120	2036	Logo1_.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1120
- C:\Users\Admin\AppData\Local\Temp\68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe
  "C:\Users\Admin\AppData\Local\Temp\68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a12F4.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe
      "C:\Users\Admin\AppData\Local\Temp\68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 124
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2452
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
ca8d3b8f9d8250daf67e6744e9cf5157

SHA1
8260cd1660afd6c44ad686d02f56d5934c13058b

SHA256
9d42fd3f7b5c98fd818fc8c466d9b66f2a5032ddbe2843c74a53335d59d97241

SHA512
8c7a6bfb7252dffdf96adb7647f0e2a047e1877befe0844c8a5452537a8d85fd1e90d8c0630f4efaf607c19935bc417f03f36ce60c895e9e2693b13252b1d242

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
c6c8fde27f649c91ddaab8cb9ca344a6

SHA1
5e4865aec432a18107182f47edda176e8c566152

SHA256
32c3fed53bfc1d890e9bd1d771fdc7e2c81480e03f1425bce07b4045a192d100

SHA512
a8df7d1e852d871d7f16bae10c4ff049359583da88cc85a039f0298525839040d5363ce5ef4cbdb92a12a25785f73df83cf0df07752b78e6e6444f32160a2155

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a12F4.bat

Filesize
722B

MD5
8b98664dc4b210e9531159be8e7cc249

SHA1
dc2c02ff3b94ae437ec456ba4b4307be9fc81e34

SHA256
4a46aca9b015f54d2234a935de2d8be9ce4ab5c2d39c3de72dcb861f6a064460

SHA512
2a55801074e62bd9fb48c48af2f12dd7fbd24a848a823ee781d92cbbb290cf20a011efbc93f94322e98018217c8d87c383e9f248dc9fd16cf86937088cc0e12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\68dd2863edf8933492f26696f6e970f204ea9c2a73c21250fafad415f82a938c.exe.exe

Filesize
63KB

MD5
e58fa0b482c0b12c20ef19ead605566c

SHA1
d955f989db7ce385ded9b93fb32c78a8fe05a051

SHA256
3b15d5fdf50add77bc7da8c90e5f2f5f5953cb7720146bbe6606de0cc9dda22d

SHA512
98203e58cd3e06845ab64f4396a6070d886c3844b897dfdf35f89a5e25107d164056eddcfaa16d28db370411ff04fd235609ec95ed27006b0d37bddc36193bbf

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
d0b6f2e25042b4e55ccc4c5ee9a53c15

SHA1
f3af8c3f61838c74a0b99eb05ce4fce62985afe6

SHA256
99cd69b0cbf830acbbc1558f087885ab8ffb5d43a1395138333500d05aa049dd

SHA512
54da4431ecd27c9f305328307c39bbc26fb8719f0312087497569161cf1482636a2526e787f05ea862d705d4f5a61f5721c568d13b52607db014c117d215f6a7

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.ini

Filesize
9B

MD5
3b22ce0fee2d1aaf2c66dcd142740e29

SHA1
94d542b4bb9854a9419753c38e6ffe747653d91c

SHA256
8284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79

SHA512
efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b

Download Submit
memory/1120-34-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/1656-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-43-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-897-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-1855-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-3022-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-3315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download