Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 18:40
Static task
static1
Behavioral task
behavioral1
Sample
b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe
Resource
win10v2004-20240226-en
General
-
Target
b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe
-
Size
53KB
-
MD5
bb42d368117036f966ac637320573196
-
SHA1
b7bb262aa512d4fd1f534d4d931d8461bf1d24db
-
SHA256
b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2
-
SHA512
785e1262a293d29c89dc5abf291f5792f212bf02048a869d0ccb0e1c237b7b4f6941ad9f4928a5708f30a41b3b0f8876eb95cff9bf561126d8f1bb8b446daf20
-
SSDEEP
768:r1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLpL/QasvFEpYinAMxklal9qYi2lauQ:BfgLdQAQfcfymN1L/Uve7Hxaio7YZxG
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2140 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exeb2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exepid process 2004 Logo1_.exe 2696 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2140 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files\Java\jre7\lib\jfr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\Templates\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
Logo1_.exeb2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exedescription ioc process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe File created C:\Windows\Logo1_.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Logo1_.exepid process 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exeLogo1_.execmd.exenet.exedescription pid process target process PID 1752 wrote to memory of 2140 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe cmd.exe PID 1752 wrote to memory of 2140 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe cmd.exe PID 1752 wrote to memory of 2140 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe cmd.exe PID 1752 wrote to memory of 2140 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe cmd.exe PID 1752 wrote to memory of 2004 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe Logo1_.exe PID 1752 wrote to memory of 2004 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe Logo1_.exe PID 1752 wrote to memory of 2004 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe Logo1_.exe PID 1752 wrote to memory of 2004 1752 b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe Logo1_.exe PID 2004 wrote to memory of 3016 2004 Logo1_.exe net.exe PID 2004 wrote to memory of 3016 2004 Logo1_.exe net.exe PID 2004 wrote to memory of 3016 2004 Logo1_.exe net.exe PID 2004 wrote to memory of 3016 2004 Logo1_.exe net.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 2140 wrote to memory of 2696 2140 cmd.exe b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe PID 3016 wrote to memory of 2632 3016 net.exe net1.exe PID 3016 wrote to memory of 2632 3016 net.exe net1.exe PID 3016 wrote to memory of 2632 3016 net.exe net1.exe PID 3016 wrote to memory of 2632 3016 net.exe net1.exe PID 2004 wrote to memory of 1144 2004 Logo1_.exe Explorer.EXE PID 2004 wrote to memory of 1144 2004 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe"C:\Users\Admin\AppData\Local\Temp\b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1390.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe"C:\Users\Admin\AppData\Local\Temp\b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe"4⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5a33a8079a96b84fb107ee4603ea5a431
SHA14d57eace6522d58ce571c31103ce1335cac7a334
SHA2563ca9dbf486bbdef38ddf2102a532563ab20f4d767c5e6228f39e606e626e76d8
SHA51229ec766ea39de2e24661a6444590fcd3421dfaf8e2f9edc6b7420331b455e9726759add01d9f53862341b7563042f089c64703edfcc38afa5f26e1e4bb64709b
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5c3e45b10166123c14907ff08c0ef6c6b
SHA1bfb32d24e0e71b21eb9a14241e178ff6f14a91ca
SHA2561c276bfbd5da801debc95abd9335971d6b333ab369dae7222554b90a4bf4b120
SHA51248b39aae1715be8c6e0ec6c5997f8d5abd671b92e50507b9ba7fef3f99e24c3b3fd1a3bd483dc1989176b02684656cba5df6ef7450bd6650481b3d054e788623
-
C:\Users\Admin\AppData\Local\Temp\b2bbdce47bf1e3230dec7b5baa9a5aba384fb50e0c29f0fa34401ce42fdc9ec2.exe.exe
Filesize26KB
MD59e4d73e24d912baa6e20a98fa4f98df3
SHA1965fbbbaa4156dcb5c6391df4d245bbf94d62c0f
SHA25628c6ce3582292ca5df81b9f8996369e82d489cc894cba9ed6b3e6678e67fc7f1
SHA5120fc58e74c7a0773a6338c35656484f2e5682a55a9c6ca03bc479728c617afc99295a3dcb52d7d414d8f5cb9c37704886f54e26acf47a3d69ebb931ce2e3bd4f2
-
Filesize
26KB
MD52fa7d646424dcabdc763a482ed72338a
SHA12917f669560129d017d689b255ff05b848a6fcd0
SHA256b6e3f8544ab9ccaaf1cb6cc51639b7173edb46f7fc186b908d8bcd50b731da69
SHA51202230628e90c8ae3397fa1c1908c9d4d27c112c7986ab6630608ce16054b1731bb06f3a129657c25a32214bd2451fe36b3f0e649073f5b8b6c86dca42d4b317b
-
Filesize
9B
MD54f2460b507685f7d7bfe6393f335f1c9
SHA1378d42f114b1515872e58de6662373af31ab8c7b
SHA25647a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
SHA51275dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb