abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
Size

64KB
MD5

41829a2e30c531e566992b8e4e30082a
SHA1

bee0c6fd15628af832aff7950b698d65dcb12329
SHA256

abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2
SHA512

9a189f8ed9bf81fa4178e3c1bcef71bbc8614a789033bf05bf2bc80a0e2d6e389bde52dbadf902bd762de623043b9c3c28e03d8738c4929c9cb81f5238ab1361
SSDEEP

1536:n3SHmLKarIpYCriw+d9bHrkT5gUHz7FxtJ:nkF3pxrBkfkT5xHzD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4212	Logo1_.exe
5060	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe
4212	Logo1_.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2032	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	91
PID 1108 wrote to memory of 2032	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	91
PID 1108 wrote to memory of 2032	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	91
PID 1108 wrote to memory of 4212	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	93
PID 1108 wrote to memory of 4212	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	93
PID 1108 wrote to memory of 4212	1108	abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe	93
PID 4212 wrote to memory of 4204	4212	Logo1_.exe	94
PID 4212 wrote to memory of 4204	4212	Logo1_.exe	94
PID 4212 wrote to memory of 4204	4212	Logo1_.exe	94
PID 2032 wrote to memory of 5060	2032	cmd.exe	96
PID 2032 wrote to memory of 5060	2032	cmd.exe	96
PID 4204 wrote to memory of 3484	4204	net.exe	97
PID 4204 wrote to memory of 3484	4204	net.exe	97
PID 4204 wrote to memory of 3484	4204	net.exe	97
PID 4212 wrote to memory of 3316	4212	Logo1_.exe	57
PID 4212 wrote to memory of 3316	4212	Logo1_.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
  "C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37A5.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe
      "C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe"
      4⤵
      Executes dropped EXE
      PID:5060
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
571KB

MD5
4d6657a2ef280d1b9cf7668c9496b43a

SHA1
56b828f2f616c35b04487f9cffe05e7d7bcd8967

SHA256
53fd6f71251539c1078b9ee7a907700a714f2ba9899f39b5d36ae117a734da6d

SHA512
b24d5df983529f3ad2952b886ab24e83041df754c5a8fabda01ebfade699b0be9c248ae38428af5c0821a51665cc0f24cfdb948a29adb95fcb927fcf6d8b4418

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a37A5.bat

Filesize
722B

MD5
d431fd7aa157d5ac7848c684c00950f6

SHA1
6a6ab796fc91692253abeac1be7e4553847da4c3

SHA256
f963345e1b0771d8ddfc444541bd22ac824d59621d3f44981f86ace55a44314e

SHA512
fe1a81e700d3a3896f9bfeeeaaee8ffe45fea092fda7843568bd6c46c413f66361fb71ba4658ec9f46bcd8ee1d8ccb1d0e3ab11f56af90e0e14b369299730098

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc5395917baa0def520cd6cce6e247557e7c313406ed309a5af9f0d5f357fd2.exe.exe

Filesize
36KB

MD5
9f498971cbe636662f3d210747d619e1

SHA1
44b8e2732fa1e2f204fc70eaa1cb406616250085

SHA256
8adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41

SHA512
b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93

Download Submit
C:\Windows\Logo1_.exe

Filesize
27KB

MD5
7172c2ec42df1e354131f8edd5b28311

SHA1
602dff3b92c124d6e646a96f4bcaf4d97515e41a

SHA256
3d247cb729ec0c6680b2a416c35c46dd9194024db2e4bbaeee5cf748c3400444

SHA512
209b3212fa26486bcebcd45fb2ffe587e5fa3ff68b770c1b0912e5f63ccae9500b770b62fda9bca0e572dc639ca051a01ab4d217ce61316d37ad015808fb2ec6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

Filesize
9B

MD5
7905486656bdf3fb568c8ea7abf7bda1

SHA1
49bd27ff3dcc248ecab0f726abb60ca35dc0e78c

SHA256
238153572e1dcd784aa47b53eba4a41558719a908862c7b3d186928fb0237b09

SHA512
b981b1fd177812b877c92b63b7261d2951b98871da87c20232cb70317a68694d7f7b24cf2f01bc3db01f192b2b8b84c7569a2472204ec4e66226d1efd14c9c14

Download Submit
memory/1108-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1108-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-37-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-19-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-26-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-42-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-70-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-1015-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-1016-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-1183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download