09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
Size 713KB
Sample240613-ydh9cssgjj
SHA256 09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9
MD5 937c6b7ae758a6577ce1dd16b33a2696
SHA1 2bc97f4b5dd1b26fe1aeed08c0684aaca3bd778c
SHA512 0d5a678f17aca0d76ab687f86ac57be6f82122a5290626785f7c3c26f305f439a2effa9ec18926148bcb43a74647dc62ea3469ab73a708be199d595ce28f6e42
SSDEEP 12288:afC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:WLOS2opPIXV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2188	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2936	Logo1_.exe
2724	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
1208	Explorer.EXE

Loads dropped DLL 2 IoCs

pid	Process
2188	cmd.exe
2188	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\ja-JP\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
File created	C:\Windows\Logo1_.exe	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe
2936	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2188	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	28
PID 1688 wrote to memory of 2188	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	28
PID 1688 wrote to memory of 2188	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	28
PID 1688 wrote to memory of 2188	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	28
PID 1688 wrote to memory of 2936	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	30
PID 1688 wrote to memory of 2936	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	30
PID 1688 wrote to memory of 2936	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	30
PID 1688 wrote to memory of 2936	1688	09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe	30
PID 2188 wrote to memory of 2724	2188	cmd.exe	32
PID 2188 wrote to memory of 2724	2188	cmd.exe	32
PID 2188 wrote to memory of 2724	2188	cmd.exe	32
PID 2188 wrote to memory of 2724	2188	cmd.exe	32
PID 2936 wrote to memory of 2976	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2976	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2976	2936	Logo1_.exe	31
PID 2936 wrote to memory of 2976	2936	Logo1_.exe	31
PID 2976 wrote to memory of 2720	2976	net.exe	34
PID 2976 wrote to memory of 2720	2976	net.exe	34
PID 2976 wrote to memory of 2720	2976	net.exe	34
PID 2976 wrote to memory of 2720	2976	net.exe	34
PID 2936 wrote to memory of 1208	2936	Logo1_.exe	21
PID 2936 wrote to memory of 1208	2936	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1208
- C:\Users\Admin\AppData\Local\Temp\09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
  "C:\Users\Admin\AppData\Local\Temp\09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1D70.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe
      "C:\Users\Admin\AppData\Local\Temp\09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe"
      4⤵
      Executes dropped EXE
      PID:2724
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 254KB
SHA256 86cfebefaf5ede042543c8a48550b01fe7ef3b6b7812000c3888319ae9dc3d2f
MD5 432aa5b6bcd692caa88869c8bdc43681
SHA1 aeb7c43781d43851f7f127b4e5adc46f743d1b14
SHA512 4f160f737ac1f8a879bbcfffc37d499ed1e26cd21f7798cc8cc430b2d0c3fa83f6f30d1c5ddc6010523c32f9a81e8756a5c723b880e61f63135f4d42b79c9058
SSDEEP 6144:muJQgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:XitXqsTkiR7twRx+gD8PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 474KB
SHA256 53b5d4205b0f2ae4ba0051244fffcaf0cfecbf78dfc448e4d2e68e53e15f15bf
MD5 6f0ec1ca208b0521f58bcd694897df06
SHA1 808a16d524301513af8ee772936f6bdcf41623a6
SHA512 d8318484059a9988dae4b8a53d1ccec1a54ed825e1937d70fccc9bd26222a0c4b23718f368e6d193e6dd7b9d999e5e8d5f23717ea160468b6287004a722503f2
SSDEEP 12288:wRZc0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVzy:aMYenGJiKEbXWtfOkUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a1D70.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1D70.bat
Size 722B
SHA256 9d5712f5824bc7bc2194610cf5aef82bd4c49408f1b538bc358beb20efbc8c58
MD5 ee090274597ffc484af4c32a9f0ec38f
SHA1 19e644f3d6115d60c71ffba40c97c3912ecec6f4
SHA512 6193f7b4b1da4b6865433b078718c88c1f9cc0683f3966c394c10c95441b79c7e89e1369d3789306079bff993ea378285b23401d06aea52ccb94843376762a6f
MD5 SHA1 SHA512

Submit Download

09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\09934b3220988829f994fba23bc5165e8968cac24ac80123d4420438b46c52c9.exe.exe
Size 684KB
SHA256 b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
MD5 50f289df0c19484e970849aac4e6f977
SHA1 3dc77c8830836ab844975eb002149b66da2e10be
SHA512 877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
SSDEEP 12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3LOS2opPIXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 73bb214769970609319af0d08f3d0938a9cad1d1fc864b23527c9474cca5b2f2
MD5 dccda60757967a88ad8a9a89f813748b
SHA1 30342bac716279dc71135ca51c669c25940a8684
SHA512 b022e816473dd0c16723393e1381ef9e99298fc6e85724eb451271c62a1f1e77541543fe02cb5e9cc7d758a3793103930288c36e7becfb7ff2716893ee228816
SSDEEP 384:Nbba2o415e6R1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOj:p9oqR16GVRu1yK9fMnJG2V9dHS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.ini
Size 9B
SHA256 47a22297ce31d17b0f37251ce63cf2eb146700451caab6dd0aa710d2526c8e42
MD5 4f2460b507685f7d7bfe6393f335f1c9
SHA1 378d42f114b1515872e58de6662373af31ab8c7b
SHA512 75dcca6b81ac47511b847a5c35be4bddbee425436f7bfd1347115e18b84f52a16a5c517bda0a5f5d0a1f2541aab80d764932d8018538cb112fa3b6c9977e95eb
MD5 SHA1 SHA512

Submit Download

memory/1208-31-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/1688-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1688-17-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1688-12-0x0000000000440000-0x0000000000476000-memory.dmp

Download

memory/2936-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-40-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-46-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-92-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-98-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-349-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-1851-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-3311-0x0000000000400000-0x0000000000436000-memory.dmp

Download