Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Resource
win10v2004-20240426-en
General
-
Target
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
-
Size
484KB
-
MD5
85a87698ab94b041f97c4829132d6173
-
SHA1
37da2d86b37878508d384c78302ad749b1f302cf
-
SHA256
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b
-
SHA512
7f197123662f611dc83a76d4b1b840c568f78ffaea752410558be06d170cfde53745728930c6b9e780bb299bfeb16ed36eb54629f2f7714d54be803b00b142c5
-
SSDEEP
6144:TVfgPRz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCG:pYR1gL5pRTcAkS/3hzN8qE43fm78V
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2256 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exeb40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exepid process 1096 Logo1_.exe 2492 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2256 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe Logo1_.exe File created C:\Program Files\Java\jre7\lib\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe Logo1_.exe File created C:\Program Files\Windows Mail\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe File created C:\Windows\Logo1_.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Logo1_.exepid process 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe 1096 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.execmd.exenet.exedescription pid process target process PID 2072 wrote to memory of 2256 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 2072 wrote to memory of 2256 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 2072 wrote to memory of 2256 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 2072 wrote to memory of 2256 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 2072 wrote to memory of 1096 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 2072 wrote to memory of 1096 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 2072 wrote to memory of 1096 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 2072 wrote to memory of 1096 2072 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 1096 wrote to memory of 2436 1096 Logo1_.exe net.exe PID 1096 wrote to memory of 2436 1096 Logo1_.exe net.exe PID 1096 wrote to memory of 2436 1096 Logo1_.exe net.exe PID 1096 wrote to memory of 2436 1096 Logo1_.exe net.exe PID 2256 wrote to memory of 2492 2256 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 2256 wrote to memory of 2492 2256 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 2256 wrote to memory of 2492 2256 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 2256 wrote to memory of 2492 2256 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 2436 wrote to memory of 2576 2436 net.exe net1.exe PID 2436 wrote to memory of 2576 2436 net.exe net1.exe PID 2436 wrote to memory of 2576 2436 net.exe net1.exe PID 2436 wrote to memory of 2576 2436 net.exe net1.exe PID 1096 wrote to memory of 1352 1096 Logo1_.exe Explorer.EXE PID 1096 wrote to memory of 1352 1096 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a9415.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
251KB
MD5a8bcad95d5ae82bbd579a77cbca70d4c
SHA10404b31bbe8d12f77e26edfbd27573f729382e1a
SHA256662862ac5c4edbaf8ad7483a8deb8ac06855ead35c2d9541bde22535283d3881
SHA512ed1969e6659530edfdfae5bcab18af7558674cd6bb87b0bfb0ade77700d4c01de79e9685eceffdb48a53c5a94026f26fbdfb3de47ddb8986a07222310aa61aca
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
471KB
MD51a0dbecba0dbb963c2f3b0448796d47a
SHA15c0b5d378d3614fe984ce2915b5720886992da0c
SHA2561ea2fb84177a921bc3df4763c3da53a970e192f93f6175d09696ded019e50cf8
SHA5128e25dc08fa6f280a6bc1ccacb1ce665ab055b5d539f8915915fc7536c90185a221cb0c50a02d34b521b871b8487a155b9c40a5f25df87306e1df24ca7e96da25
-
C:\Users\Admin\AppData\Local\Temp\$$a9415.batFilesize
722B
MD5825133af72133f07636e7bd8c06644c7
SHA1716401b36475a23ceaa9593ba2d906060385c423
SHA25684fae3d7c4c640278cfb0ae96b9042884a10d8da40f80913792c69e74b9f3305
SHA5126a62348b17e09dd5198be7f5d010beb64dc2e829c4bd788a868c98ae7a80adbb12bbd2dc8103d779fcbd7466af6a0566c0b59f96fa4b002d221ceb07320219f9
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\Windows\Logo1_.exeFilesize
26KB
MD57e2d4dc228c87c716412c5f88c8ba1bc
SHA168a1f791f9c818e50919266b4b8fdacbd342f8a4
SHA25660da23d6016a27add33a1c2376bb53a25d04ff24679e9fde80ea37e8204abe4a
SHA512acd4e4ace4c823cf71bcfa44ea4ef8058f9feca480b671cab8e4effd4271e94084c7119a711dbfc9fe7bcb7005e912531c6406141e11748ed3811ac8023d63db
-
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.iniFilesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b
-
memory/1096-19-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-1851-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-3311-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-32-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-180-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-39-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-45-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-91-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1096-97-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1352-30-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/2072-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2072-16-0x00000000002D0000-0x0000000000304000-memory.dmpFilesize
208KB
-
memory/2072-18-0x00000000002D0000-0x0000000000304000-memory.dmpFilesize
208KB
-
memory/2072-15-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB