Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe
Resource
win10v2004-20240226-en
General
-
Target
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe
-
Size
957KB
-
MD5
b6eb519f9d99a37e6435c3c0e5621a8f
-
SHA1
ae283a2450c3362365ffcc9f8d0e7934eb1d0bd4
-
SHA256
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10
-
SHA512
0a567a0ab98082be0ae28b39e0e561e0b5452244fe13b08a57bb1804e99ba363b6202531ee3bfbb58aa6f5b790b81d86dc96403efb8f31bbcebf6914a62d7081
-
SSDEEP
12288:8p7RKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:8pEBpDRmi78gkPXlyo0G/jr
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2788 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exea7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exepid process 2112 Logo1_.exe 2740 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2788 cmd.exe 2788 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLSTART\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe File created C:\Windows\Logo1_.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Logo1_.exepid process 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe 2112 Logo1_.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exepid process 2740 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exedescription pid process Token: SeRestorePrivilege 2740 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe Token: 35 2740 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exeLogo1_.execmd.exenet.exedescription pid process target process PID 2108 wrote to memory of 2788 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe cmd.exe PID 2108 wrote to memory of 2788 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe cmd.exe PID 2108 wrote to memory of 2788 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe cmd.exe PID 2108 wrote to memory of 2788 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe cmd.exe PID 2108 wrote to memory of 2112 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe Logo1_.exe PID 2108 wrote to memory of 2112 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe Logo1_.exe PID 2108 wrote to memory of 2112 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe Logo1_.exe PID 2108 wrote to memory of 2112 2108 a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe Logo1_.exe PID 2112 wrote to memory of 2352 2112 Logo1_.exe net.exe PID 2112 wrote to memory of 2352 2112 Logo1_.exe net.exe PID 2112 wrote to memory of 2352 2112 Logo1_.exe net.exe PID 2112 wrote to memory of 2352 2112 Logo1_.exe net.exe PID 2788 wrote to memory of 2740 2788 cmd.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe PID 2788 wrote to memory of 2740 2788 cmd.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe PID 2788 wrote to memory of 2740 2788 cmd.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe PID 2788 wrote to memory of 2740 2788 cmd.exe a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe PID 2352 wrote to memory of 1224 2352 net.exe net1.exe PID 2352 wrote to memory of 1224 2352 net.exe net1.exe PID 2352 wrote to memory of 1224 2352 net.exe net1.exe PID 2352 wrote to memory of 1224 2352 net.exe net1.exe PID 2112 wrote to memory of 1232 2112 Logo1_.exe Explorer.EXE PID 2112 wrote to memory of 1232 2112 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe"C:\Users\Admin\AppData\Local\Temp\a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1EC7.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe"C:\Users\Admin\AppData\Local\Temp\a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
252KB
MD50b2679dc1eb882abf56d11ca591aeb76
SHA17a5c7ff9a42f9c84873d269d1e776a89045a1f45
SHA2563d1b129d45f7fe6c861e380906a0c97576a804240426a0d2408f131cbaedc354
SHA5128661ecb16631ac033db4d7ee8aa291647ca3311888988693633acd1a69fd9d6eb890c94c97656602c47964219a082f875bce41710fe036cf546c29ae49e2e114
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
C:\Users\Admin\AppData\Local\Temp\$$a1EC7.batFilesize
722B
MD574dd428ad892cfa8c1366fb51010329b
SHA1e105eee87d7a2e5cb202c4b1cb227ef513b31cad
SHA25665917722b9931a15a86cf9cccfd010f4637ef629e54f73516296225129f6adb7
SHA51248014d907424982e87d5c856cf02021d69fd89073ae3ef3d18ea6e00c494500d1b8bebf428a5cf4cbe1fa98fc17261d07e497961e44c0ac455caa7b4d9c36a19
-
C:\Users\Admin\AppData\Local\Temp\a7e9ac6ea4c507a86350c65f7a47cb5754365acc472321ad4982d9e63cf71c10.exe.exeFilesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
C:\Windows\Logo1_.exeFilesize
27KB
MD5d0d42004d5e14fecf764dc99963c82fa
SHA12b05a3b17e23a16df2a838d31d8c4113993dd833
SHA256fe58d080c6a43f69deaec1b3fa9ffa2963dd9a3384b6f3aa9895c4dd2c485a8f
SHA51272f9b71e46512dfcec9bd294930cc9a01acdb8c5b33a3c9a48c9475889f300e35d13191e5868c9798fd335af5a32793f19180b9d015ec18d2b112d0ac1749bee
-
F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\_desktop.iniFilesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b
-
memory/1232-30-0x0000000002DE0000-0x0000000002DE1000-memory.dmpFilesize
4KB
-
memory/2108-16-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2108-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-18-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-46-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-93-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-99-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-492-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-1876-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-40-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-3336-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2112-33-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB