abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
Size

64KB
MD5

41829a2e30c531e566992b8e4e30082a
SHA1

bee0c6fd15628af832aff7950b698d65dcb12329
SHA256

abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2
SHA512

9a189f8ed9bf81fa4178e3c1bcef71bbc8614a789033bf05bf2bc80a0e2d6e389bde52dbadf902bd762de623043b9c3c28e03d8738c4929c9cb81f5238ab1361
SSDEEP

1536:n3SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:nkF3pxrBkfkT5xHzD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1744	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2912	Logo1_.exe
2720	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
File created	C:\Windows\Logo1_.exe	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe
2912	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1744	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	28
PID 2604 wrote to memory of 1744	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	28
PID 2604 wrote to memory of 1744	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	28
PID 2604 wrote to memory of 1744	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	28
PID 2604 wrote to memory of 2912	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	29
PID 2604 wrote to memory of 2912	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	29
PID 2604 wrote to memory of 2912	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	29
PID 2604 wrote to memory of 2912	2604	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	29
PID 1744 wrote to memory of 2720	1744	cmd.exe	32
PID 1744 wrote to memory of 2720	1744	cmd.exe	32
PID 1744 wrote to memory of 2720	1744	cmd.exe	32
PID 1744 wrote to memory of 2720	1744	cmd.exe	32
PID 2912 wrote to memory of 2648	2912	Logo1_.exe	31
PID 2912 wrote to memory of 2648	2912	Logo1_.exe	31
PID 2912 wrote to memory of 2648	2912	Logo1_.exe	31
PID 2912 wrote to memory of 2648	2912	Logo1_.exe	31
PID 2648 wrote to memory of 2652	2648	net.exe	34
PID 2648 wrote to memory of 2652	2648	net.exe	34
PID 2648 wrote to memory of 2652	2648	net.exe	34
PID 2648 wrote to memory of 2652	2648	net.exe	34
PID 2912 wrote to memory of 1208	2912	Logo1_.exe	21
PID 2912 wrote to memory of 1208	2912	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
  "C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1323.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
      "C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe"
      4⤵
      Executes dropped EXE
      PID:2720
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
252KB

MD5
7575a6b072ee8c5aa7af8c4808698f28

SHA1
5031f3b96144e652e7e39e9dd94e341aacefb65d

SHA256
a7e69e20bb50901e46d50a6b9acc508b637f715417786edd67155b78948fdc5a

SHA512
f33f1e6c4cf90c9c5e9b8c433b8f84bf9e7d738e7eb66bc838c838c3dda911ee87a52e4ac61f1442122a5a882133d1e47f15e9133f711ba97eebe62017fe8db2

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
472KB

MD5
88eb1bca8c399bc3f46e99cdde2f047e

SHA1
55fafbceb011e1af2edced978686a90971bd95f2

SHA256
42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

SHA512
149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a1323.bat

Filesize
722B

MD5
17f69fb4b6cfa7088735902da467b3c1

SHA1
3f8f60156d0cecfe0e30de4d7aafc792e74922c6

SHA256
48ee0481df57fae3941e341ce9870bffade2bb5dc0c03032699ea3c4bf6afb9b

SHA512
ae3efe1e2caf6801adcc0f8fcdaa28cc6e6a51cce5cac18b2bc79abeb4674a80b9d395aaaf2af9a23dbd449584b9d311f9d9fb5a62ea47282ee022a845b4a416

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe.exe

Filesize
36KB

MD5
9f498971cbe636662f3d210747d619e1

SHA1
44b8e2732fa1e2f204fc70eaa1cb406616250085

SHA256
8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

SHA512
b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

Download Submit
C:\Windows\Logo1_.exe

Filesize
27KB

MD5
7172c2ec42df1e354131f8edd5b28311

SHA1
602dff3b92c124d6e646a96f4bcaf4d97515e41a

SHA256
3d247cb729ec0c6680b2a416c35c46dd9194024db2e4bbaeee5cf748c3400444

SHA512
209b3212fa26486bcebcd45fb2ffe587e5fa3ff68b770c1b0912e5f63ccae9500b770b62fda9bca0e572dc639ca051a01ab4d217ce61316d37ad015808fb2ec6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\_desktop.ini

Filesize
9B

MD5
7905486656bdf3fb568c8ea7abf7bda1

SHA1
49bd27ff3dcc248ecab0f726abb60ca35dc0e78c

SHA256
238153572e1dcd784aa47b53eba4a41558719a908862c7b3d186928fb0237b09

SHA512
b981b1fd177812b877c92b63b7261d2951b98871da87c20232cb70317a68694d7f7b24cf2f01bc3db01f192b2b8b84c7569a2472204ec4e66226d1efd14c9c14

Download Submit
memory/1208-31-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/2604-12-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download
memory/2604-16-0x00000000002C0000-0x00000000002F5000-memory.dmp

Filesize
212KB

Download
memory/2604-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2604-19-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-20-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-46-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-92-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-98-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-508-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-1875-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-2038-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-3335-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download