Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe
Resource
win10v2004-20240611-en
General
-
Target
90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe
-
Size
389KB
-
MD5
862d054c3d16d3d265edbe551c03b333
-
SHA1
cf3672b911f20186596cc87d4e3e8effc4096aab
-
SHA256
90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80
-
SHA512
5bab9f24ec58b12f665f313ae08d8da1fdcb218240ddd7273dd4534e1037375b3781a7a46d2c7c22f9593725c58b3163fc846ebf6ff34eee89b49251f27a428f
-
SSDEEP
6144:YuJ6P2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1moHXG:NahVy41
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3404 Logo1_.exe 932 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\cs-CZ\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe File created C:\Windows\Logo1_.exe 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe 3404 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4436 wrote to memory of 3820 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 80 PID 4436 wrote to memory of 3820 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 80 PID 4436 wrote to memory of 3820 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 80 PID 4436 wrote to memory of 3404 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 81 PID 4436 wrote to memory of 3404 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 81 PID 4436 wrote to memory of 3404 4436 90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe 81 PID 3404 wrote to memory of 3412 3404 Logo1_.exe 82 PID 3404 wrote to memory of 3412 3404 Logo1_.exe 82 PID 3404 wrote to memory of 3412 3404 Logo1_.exe 82 PID 3412 wrote to memory of 4588 3412 net.exe 85 PID 3412 wrote to memory of 4588 3412 net.exe 85 PID 3412 wrote to memory of 4588 3412 net.exe 85 PID 3820 wrote to memory of 932 3820 cmd.exe 87 PID 3820 wrote to memory of 932 3820 cmd.exe 87 PID 3404 wrote to memory of 3444 3404 Logo1_.exe 55 PID 3404 wrote to memory of 3444 3404 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe"C:\Users\Admin\AppData\Local\Temp\90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36EE.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe"C:\Users\Admin\AppData\Local\Temp\90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe"4⤵
- Executes dropped EXE
PID:932
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4588
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD548b536408ac1a66263ed8da4ec21add8
SHA162d20d73d6035d5ce1e1bf1068ff3bf52d609c3b
SHA256fbc2cf414606174f3555d76fe647557b72ac47e6bda0864fd8c5dad738df1733
SHA51244f09df70cb4cafa63f88899b0b0fa07bf8fcd5d0106a9a945453de7570c37985039c4a7267708815b6c707539e9a4472d329f010f6a692c5c1fcaab6c41f1c0
-
Filesize
573KB
MD570c4e6e39f45b3c462a19493e22a89e6
SHA1a1b00301c3deedabdb6a835d9cf3660aaf8502af
SHA25649d406bec2126ed4f1d6ea4ec7a64f33175753629b34a8da54e46f89bce1c77d
SHA5124d192c0e8a63addfc044f923d34c12704ec2ec9cedbf6489838bd5a0960c4f38ff89560f684aeae5a4666d0b19f271d4f830a5a482d9a80a58de3a49d7a9a4eb
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize639KB
MD5f1a31b2ce27caa12b0c83698d2266dbe
SHA141d0f0731185588db910853ce965e677bd2e53e5
SHA256c013780783b3c6105da7ffd4b46452fadec0336c22a310fc20a3b67778855105
SHA512a12d12be843f39c38bc6e596c08760744bf07f4a06636a592a883989ec4467b76b9ca6b859bfd997a9d6cb85e3abbac82729e71ea989df9d3ba065e740e12206
-
Filesize
722B
MD57ac9b3231badd98a7da22ad72890546f
SHA115c833c6dd9887729397762cf84147beb81d501b
SHA256e62b23f85333e242932d04fdaaed88b13ccd3580891e160d667f27b7582117a6
SHA512752dfaa2f8bc0c36bd942f40a0313aba5dfd8dbfaf44ad884c255ee4009c3cd0f89873e2057719988e3d168dd8c7ebedd1929fc4448a2baa04c713cee91ae0da
-
C:\Users\Admin\AppData\Local\Temp\90fdacd4ce6f6a3efeeb4ca4d9b856f4ce29232f56f01ed71d5d5fa3d94a2a80.exe.exe
Filesize360KB
MD55fbd45261a2de3bb42f489e825a9a935
SHA1ff388f6e9efe651ec62c4152c1739783e7899293
SHA2569e63701598199d5c47217e23b44d0e3ec5d53f5419166b1b6c68a7e9e8fc47a4
SHA5127f22b1995a07016adb342c551454d602bfbe511525139aee8581b62116608e9e278fd81c26382f1333c7eccded4474196e73c093bb5cbf8e8f203e865024c058
-
Filesize
29KB
MD59fcfb6b631b5a62c2af6f852de61dc71
SHA102149b5ae9d7c72cc2df500a9cf25ef4234614e1
SHA256470ca7731bbe27be0922d68e5479cc10f87a1b29acfbe44a506414761a379a2a
SHA51269076244e4c53b09a9d3595e6b53201013ce006da986542f8375223640e5ce66d000c9f02c71d3856ea0f3f788c139fce670ae26c571bd71d801bd67e15cb66a
-
Filesize
9B
MD51f206a052c160fd77308863abd810887
SHA13b27ec1dc4b51fb7f1793a9ca9bb0d2e53e60eb1
SHA25645129bd309ca763a88c6bf438896e82b939d6491036658c4512c57f8353938c1
SHA512bd7857c146b01a49d34d4eb84053353eeb586bee6916426179305d5e2360559adea4040fe2184a3a803943ff4e6526cc38c665f9a808355619628868d53fbed5