Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe
-
Size
2.1MB
-
MD5
4a7c5dd30a160b6db881e48e322799a0
-
SHA1
f0425f4952ef4a80828f99e33398d02b968d8dbb
-
SHA256
7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434
-
SHA512
ff192e69d45e1a1192d8d8054e2f66f1a73f4800498e24775e219643b553a36237c0a491c740b2d0244f1d7d14eeed27ea114486cbfeaeaaf232f788f8eca420
-
SSDEEP
24576:1/0WSW6GDtO0JEKdPX0//TYJzSgXQqRNKRkZ8prUti2QwhNXqOxcS0eUK9VyxjGP:CW7Q0AWzFQqRNGpIti6XVyxCC8
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3952 Logo1_.exe 1872 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe 3952 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1404 wrote to memory of 440 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 81 PID 1404 wrote to memory of 440 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 81 PID 1404 wrote to memory of 440 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 81 PID 1404 wrote to memory of 3952 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 83 PID 1404 wrote to memory of 3952 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 83 PID 1404 wrote to memory of 3952 1404 7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe 83 PID 3952 wrote to memory of 3532 3952 Logo1_.exe 84 PID 3952 wrote to memory of 3532 3952 Logo1_.exe 84 PID 3952 wrote to memory of 3532 3952 Logo1_.exe 84 PID 3532 wrote to memory of 1264 3532 net.exe 86 PID 3532 wrote to memory of 1264 3532 net.exe 86 PID 3532 wrote to memory of 1264 3532 net.exe 86 PID 440 wrote to memory of 1872 440 cmd.exe 88 PID 440 wrote to memory of 1872 440 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe"C:\Users\Admin\AppData\Local\Temp\7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA59.bat2⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe"C:\Users\Admin\AppData\Local\Temp\7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe"3⤵
- Executes dropped EXE
PID:1872
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1264
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996KB
MD506b5415a34c6c66d99d5180d4818528e
SHA1dbf4063458d1ef2fa55d8e4b6aeb7aacdd463c77
SHA25642652ac809dc625f2832587499bc5fa4ddb41260bd2a221d8b4d07d656df66a9
SHA512d23ac48e52bb5972d4b848a28ecd873726674924a5508a43a8030947787c17fb7737571624b762c830a3c112a0a623e43b00c22c6341df13b5838ee785a9b97b
-
Filesize
722B
MD593984bc58cb8bf3ab1b551f4f384d858
SHA199dc9d45b74f08ca6e21fa23570e7c9430601979
SHA256a57d3a0cdee4fdca0165aaeea5362790197d31f37bda148a5891b11eaeafb7b0
SHA512ed054fa670448d0d4bbd2413e2961aa32d34dd804cbc0ab431238b1d9976488fe80438c64690f224e2cfb550c72eb45fb7309315305f6fd116c36beb210c5672
-
C:\Users\Admin\AppData\Local\Temp\7038d95750239551d425d3a164392b1c1f64472aed433a7637804b0a70064434.exe.exe
Filesize2.1MB
MD5402390d994e77de56911e140161252c9
SHA1ca0b8ea615c6b4397ca92d45345279ea985b503a
SHA256880df0a0158b3c6077526cafca5fe9ae96a0f82b23b936fdee6e2f88a30b3e63
SHA5124a8c23bb1131255c060f1be54b788971881f72225aad1fe9a3b8019298d14bf75db3fd98b7906f8a0ccb4f83ae0b6e5679915260c7b1d51491b5385d9ad96c40
-
Filesize
66KB
MD5a81c8cb12d60acf8c759fa71889799c6
SHA1797ea1fb6f2704e56448db6ff0992d5bc322b4ad
SHA256c8d74f72173f6a12145368db4df2d22522e58e06973e4360293fb6d83375079e
SHA512c8ddf074f4d467e170211fbcbca12fbec25b8ebcf40c0969bc9e9130c12337e633e5d8000803c1dfccb9edd34756c8beb2af66edeb1b39905b46534e1ea9bd67