Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe
Resource
win10v2004-20240226-en
General
-
Target
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe
-
Size
362KB
-
MD5
2f63a43b17a1ad49b365e2123b795485
-
SHA1
cb7b1ec56a717738ba0000906e1f6f3466e8d7ba
-
SHA256
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d
-
SHA512
ea90f1acef82576cfd8842107c1f95b131a7c555d1f6d42232765eced4734e0ea16f39598c97d81d6d32f9d1a79ee776426b464b90e1777378ffa74ae39c8495
-
SSDEEP
6144:vCFp9zU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:8pRU66b5zhVymA/XSRh
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2116 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exead72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exepid process 2564 Logo1_.exe 2532 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2116 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\Templates\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe Logo1_.exe File created C:\Program Files\Microsoft Games\FreeCell\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe File created C:\Windows\Logo1_.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Logo1_.exepid process 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exeLogo1_.execmd.exenet.exedescription pid process target process PID 2856 wrote to memory of 2116 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe cmd.exe PID 2856 wrote to memory of 2116 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe cmd.exe PID 2856 wrote to memory of 2116 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe cmd.exe PID 2856 wrote to memory of 2116 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe cmd.exe PID 2856 wrote to memory of 2564 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe Logo1_.exe PID 2856 wrote to memory of 2564 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe Logo1_.exe PID 2856 wrote to memory of 2564 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe Logo1_.exe PID 2856 wrote to memory of 2564 2856 ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe Logo1_.exe PID 2564 wrote to memory of 2752 2564 Logo1_.exe net.exe PID 2564 wrote to memory of 2752 2564 Logo1_.exe net.exe PID 2564 wrote to memory of 2752 2564 Logo1_.exe net.exe PID 2564 wrote to memory of 2752 2564 Logo1_.exe net.exe PID 2116 wrote to memory of 2532 2116 cmd.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe PID 2116 wrote to memory of 2532 2116 cmd.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe PID 2116 wrote to memory of 2532 2116 cmd.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe PID 2116 wrote to memory of 2532 2116 cmd.exe ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe PID 2752 wrote to memory of 2636 2752 net.exe net1.exe PID 2752 wrote to memory of 2636 2752 net.exe net1.exe PID 2752 wrote to memory of 2636 2752 net.exe net1.exe PID 2752 wrote to memory of 2636 2752 net.exe net1.exe PID 2564 wrote to memory of 1200 2564 Logo1_.exe Explorer.EXE PID 2564 wrote to memory of 1200 2564 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe"C:\Users\Admin\AppData\Local\Temp\ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a5E.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe"C:\Users\Admin\AppData\Local\Temp\ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
252KB
MD50b2679dc1eb882abf56d11ca591aeb76
SHA17a5c7ff9a42f9c84873d269d1e776a89045a1f45
SHA2563d1b129d45f7fe6c861e380906a0c97576a804240426a0d2408f131cbaedc354
SHA5128661ecb16631ac033db4d7ee8aa291647ca3311888988693633acd1a69fd9d6eb890c94c97656602c47964219a082f875bce41710fe036cf546c29ae49e2e114
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
C:\Users\Admin\AppData\Local\Temp\$$a5E.batFilesize
720B
MD5e718ef0352758b1d73ba92e1475feb16
SHA132cd76abb7c1e797c534ea7181a4f6c8b8fc634d
SHA2568c822508250ef840c7cf759bbe47ec558b4218aef92063583b5e5082bf4a4dfb
SHA512de6612a6d266c39bcff5bc6c14eee2578b9ee3b2ff954501fd03d152c14a11e19dfa4e3fa8c96d1beb66b9bc07c11587af58b624adb2859943222ca57280d535
-
C:\Users\Admin\AppData\Local\Temp\ad72841c2b838e70dc03921d9a1885e0b9c2254a3ca5a97034fccf8d32d07f1d.exe.exeFilesize
335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
C:\Windows\Logo1_.exeFilesize
27KB
MD5d0d42004d5e14fecf764dc99963c82fa
SHA12b05a3b17e23a16df2a838d31d8c4113993dd833
SHA256fe58d080c6a43f69deaec1b3fa9ffa2963dd9a3384b6f3aa9895c4dd2c485a8f
SHA51272f9b71e46512dfcec9bd294930cc9a01acdb8c5b33a3c9a48c9475889f300e35d13191e5868c9798fd335af5a32793f19180b9d015ec18d2b112d0ac1749bee
-
F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\_desktop.iniFilesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b
-
memory/1200-29-0x0000000002E40000-0x0000000002E41000-memory.dmpFilesize
4KB
-
memory/2564-18-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-31-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-38-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-44-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-90-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-96-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-767-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-1849-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-2702-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2564-3309-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2856-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2856-16-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB