Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe
Resource
win10v2004-20240426-en
General
-
Target
41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe
-
Size
571KB
-
MD5
14a1606ee014690541ddd1c51169cba2
-
SHA1
2a75e583a802f1737912793c4977721b976a29b8
-
SHA256
41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065
-
SHA512
cd36672cd1ad94990e928c81e872d2ec9fa0cb0765b0002b5b676d62f801ac6df077ab042eb978a1f9fef644e92d08ef2cdc6f860d2161b0e12848108fa7fef7
-
SSDEEP
6144:vCFpnE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:8pE7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2884 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exe41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exepid process 2640 Logo1_.exe 2580 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2884 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files\Java\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
Logo1_.exe41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exedescription ioc process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe File created C:\Windows\Logo1_.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Logo1_.exepid process 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe 2640 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exeLogo1_.execmd.exenet.exedescription pid process target process PID 1312 wrote to memory of 2884 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe cmd.exe PID 1312 wrote to memory of 2884 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe cmd.exe PID 1312 wrote to memory of 2884 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe cmd.exe PID 1312 wrote to memory of 2884 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe cmd.exe PID 1312 wrote to memory of 2640 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe Logo1_.exe PID 1312 wrote to memory of 2640 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe Logo1_.exe PID 1312 wrote to memory of 2640 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe Logo1_.exe PID 1312 wrote to memory of 2640 1312 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe Logo1_.exe PID 2640 wrote to memory of 2680 2640 Logo1_.exe net.exe PID 2640 wrote to memory of 2680 2640 Logo1_.exe net.exe PID 2640 wrote to memory of 2680 2640 Logo1_.exe net.exe PID 2640 wrote to memory of 2680 2640 Logo1_.exe net.exe PID 2884 wrote to memory of 2580 2884 cmd.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe PID 2884 wrote to memory of 2580 2884 cmd.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe PID 2884 wrote to memory of 2580 2884 cmd.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe PID 2884 wrote to memory of 2580 2884 cmd.exe 41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe PID 2680 wrote to memory of 1400 2680 net.exe net1.exe PID 2680 wrote to memory of 1400 2680 net.exe net1.exe PID 2680 wrote to memory of 1400 2680 net.exe net1.exe PID 2680 wrote to memory of 1400 2680 net.exe net1.exe PID 2640 wrote to memory of 1212 2640 Logo1_.exe Explorer.EXE PID 2640 wrote to memory of 1212 2640 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe"C:\Users\Admin\AppData\Local\Temp\41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a257B.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe"C:\Users\Admin\AppData\Local\Temp\41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe"4⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD50b2679dc1eb882abf56d11ca591aeb76
SHA17a5c7ff9a42f9c84873d269d1e776a89045a1f45
SHA2563d1b129d45f7fe6c861e380906a0c97576a804240426a0d2408f131cbaedc354
SHA5128661ecb16631ac033db4d7ee8aa291647ca3311888988693633acd1a69fd9d6eb890c94c97656602c47964219a082f875bce41710fe036cf546c29ae49e2e114
-
Filesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
Filesize
722B
MD5faf6eab4339f15d0e363810ce6d797c8
SHA1601f55a1421c628de4b2b45717c6778566d1b473
SHA25646b75783cb69cd1b59effe3dc14a033dea783bea2c463a0ac2408ee9228ce386
SHA51222a62345afc71bf4aafe11cbdd253c6d57f953f58bdba2973182bc9009151adf051851bc89e32005367dc00c4e13c98bef5194714bb147c2b226c50614f46054
-
C:\Users\Admin\AppData\Local\Temp\41a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
27KB
MD5d0d42004d5e14fecf764dc99963c82fa
SHA12b05a3b17e23a16df2a838d31d8c4113993dd833
SHA256fe58d080c6a43f69deaec1b3fa9ffa2963dd9a3384b6f3aa9895c4dd2c485a8f
SHA51272f9b71e46512dfcec9bd294930cc9a01acdb8c5b33a3c9a48c9475889f300e35d13191e5868c9798fd335af5a32793f19180b9d015ec18d2b112d0ac1749bee
-
Filesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b