b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b

General

Target

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Size

484KB
MD5

85a87698ab94b041f97c4829132d6173
SHA1

37da2d86b37878508d384c78302ad749b1f302cf
SHA256

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b
SHA512

7f197123662f611dc83a76d4b1b840c568f78ffaea752410558be06d170cfde53745728930c6b9e780bb299bfeb16ed36eb54629f2f7714d54be803b00b142c5
SSDEEP

6144:TVfgPRz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCG:pYR1gL5pRTcAkS/3hzN8qE43fm78V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exeb40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe

pid process

4000 Logo1_.exe
4196 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
File created	C:\Windows\Logo1_.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Logo1_.exe

pid	process
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe
4000	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exenet.execmd.exe

description	pid	process	target process
PID 4652 wrote to memory of 2016	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 4652 wrote to memory of 2016	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 4652 wrote to memory of 2016	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	cmd.exe
PID 4652 wrote to memory of 4000	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 4652 wrote to memory of 4000	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 4652 wrote to memory of 4000	4652	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe	Logo1_.exe
PID 4000 wrote to memory of 1200	4000	Logo1_.exe	net.exe
PID 4000 wrote to memory of 1200	4000	Logo1_.exe	net.exe
PID 4000 wrote to memory of 1200	4000	Logo1_.exe	net.exe
PID 1200 wrote to memory of 2372	1200	net.exe	net1.exe
PID 1200 wrote to memory of 2372	1200	net.exe	net1.exe
PID 1200 wrote to memory of 2372	1200	net.exe	net1.exe
PID 2016 wrote to memory of 4196	2016	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 2016 wrote to memory of 4196	2016	cmd.exe	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
PID 4000 wrote to memory of 2940	4000	Logo1_.exe	Explorer.EXE
PID 4000 wrote to memory of 2940	4000	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a351A.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"
4⤵
- Executes dropped EXE
PID:4196

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Filesize
251KB

MD5
a8bcad95d5ae82bbd579a77cbca70d4c

SHA1
0404b31bbe8d12f77e26edfbd27573f729382e1a

SHA256
662862ac5c4edbaf8ad7483a8deb8ac06855ead35c2d9541bde22535283d3881

SHA512
ed1969e6659530edfdfae5bcab18af7558674cd6bb87b0bfb0ade77700d4c01de79e9685eceffdb48a53c5a94026f26fbdfb3de47ddb8986a07222310aa61aca

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
570KB

MD5
18931813e78b1f2f20c798ccc65caa45

SHA1
3ea910f3b09412dd8cddde3da0b42154cb78c60e

SHA256
3873df5384a7449171451d94fb989c753c214fff58dd0a2c1926523f99b7913b

SHA512
a6e29f632ee13a9cd007f6f592901086c6a30be5bd3b92cac94bdc7509228ca17d6166ff167162419f4441488360baf50a6746d380961428a37c5f86b981e882

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize
636KB

MD5
26f10ae795ba6df10c2779f4a535b449

SHA1
f00986886ad07550c909b9f02b7b3a9c310e8b0f

SHA256
996761040fa3726dbdda9dd94f543e7d0f26f58b5c7a122e900e56b2dacdc7b8

SHA512
5f5ea3a050876256571610eec85456ac6b3469ddaa10a6c62d621081718cf8eeedc21cf6381c49c835c6b61690b7c41107b357bb14c044ace1dfe7f827baa93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a351A.bat
Filesize
722B

MD5
9fd9b6b9a208ff6389a98f1777f4e803

SHA1
b738a743be6170ef56556c3cf88f7dfcb04a9619

SHA256
55e4e9786cec4e4ca76087e470690572ad983fcc681dd16f13599312223033f8

SHA512
6d207e94ee5d3c686854f399c7cd0e0555062b034521e5706985c6eb56febed4d90d623920382539272444f108120a650740d7f6dfee42947c31aae20fd59d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\Logo1_.exe
Filesize
26KB

MD5
7e2d4dc228c87c716412c5f88c8ba1bc

SHA1
68a1f791f9c818e50919266b4b8fdacbd342f8a4

SHA256
60da23d6016a27add33a1c2376bb53a25d04ff24679e9fde80ea37e8204abe4a

SHA512
acd4e4ace4c823cf71bcfa44ea4ef8058f9feca480b671cab8e4effd4271e94084c7119a711dbfc9fe7bcb7005e912531c6406141e11748ed3811ac8023d63db

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini
Filesize
9B

MD5
3b22ce0fee2d1aaf2c66dcd142740e29

SHA1
94d542b4bb9854a9419753c38e6ffe747653d91c

SHA256
8284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79

SHA512
efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b

Download Submit
memory/4000-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-37-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-1231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-4797-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-5236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4652-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4652-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

pid	process
4000	Logo1_.exe
4196	b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads