Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68003325a255254edf94d093e7461720N.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
68003325a255254edf94d093e7461720N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
68003325a255254edf94d093e7461720N.exe
-
Size
411KB
-
MD5
68003325a255254edf94d093e7461720
-
SHA1
21675fffcbdd7442c2be581225f65cf77ad66db6
-
SHA256
58bcc976fe54852e2cfdb309cb0facdb8779151fd2228add5765df2fdd662742
-
SHA512
f033d7ea3b4d77eadb5a836acbfdc6911c8585332d38b69455ac9c3ada9dcbbb9155f5c4a9c9141b31d2fb15aea4e80123951f806c614b69e360d877f4aa494c
-
SSDEEP
6144:XLZ/Jdur0RsrJ3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKE:1/J8AqwKhHSDeWTRW8fdebE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2524 Logo1_.exe 4948 68003325a255254edf94d093e7461720N.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 68003325a255254edf94d093e7461720N.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe 2524 Logo1_.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4520 4868 68003325a255254edf94d093e7461720N.exe 84 PID 4868 wrote to memory of 4520 4868 68003325a255254edf94d093e7461720N.exe 84 PID 4868 wrote to memory of 4520 4868 68003325a255254edf94d093e7461720N.exe 84 PID 4868 wrote to memory of 2524 4868 68003325a255254edf94d093e7461720N.exe 85 PID 4868 wrote to memory of 2524 4868 68003325a255254edf94d093e7461720N.exe 85 PID 4868 wrote to memory of 2524 4868 68003325a255254edf94d093e7461720N.exe 85 PID 2524 wrote to memory of 4908 2524 Logo1_.exe 87 PID 2524 wrote to memory of 4908 2524 Logo1_.exe 87 PID 2524 wrote to memory of 4908 2524 Logo1_.exe 87 PID 4908 wrote to memory of 4932 4908 net.exe 89 PID 4908 wrote to memory of 4932 4908 net.exe 89 PID 4908 wrote to memory of 4932 4908 net.exe 89 PID 4520 wrote to memory of 4948 4520 cmd.exe 90 PID 4520 wrote to memory of 4948 4520 cmd.exe 90 PID 4520 wrote to memory of 4948 4520 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\68003325a255254edf94d093e7461720N.exe"C:\Users\Admin\AppData\Local\Temp\68003325a255254edf94d093e7461720N.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7B3.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\68003325a255254edf94d093e7461720N.exe"C:\Users\Admin\AppData\Local\Temp\68003325a255254edf94d093e7461720N.exe"3⤵
- Executes dropped EXE
PID:4948
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4932
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
750KB
MD5b072e7e1e595a0e344cf35c208536f60
SHA1b302bd8a085947c3ff47769904ed8503353bcd3d
SHA256db7f13b6cd724b504b5ede8a9f7378ae2b5ba7008369c0cac2652019f94067dc
SHA51203abf09ee51e7f7f8283869efdb1da10a088e74b62d070a5b9ed06f92003a67e037c7bfdb28bc5435e2ac4cd0a23b981b1a332da64f37f45c2b2564293221126
-
Filesize
536B
MD587faec2b4146578076803ec900b34368
SHA110dcaa6f063281a8abe9301b197ee50d6722c5db
SHA2568d7c2f54a1c1748308809c593b07174ed62e1001430600cfdf8b35f20ba9a0c3
SHA51254300c9731e3685b47d722301b8dbd25ec2c65f472b72ea7247fb20fffca26576d6ed278848423537cdd1692056f7afac3e367f76ba67349c302703fcadf26a9
-
Filesize
345KB
MD56623abd95d6ca5b4e9d78570d1e531ad
SHA1dd734ce4057e98af82197af22a436b3ae05e1af9
SHA256db197e4e2d60b8161a5cf5c41a9d3d1d5cc694c19fe96d71e33747dd20c1d4b3
SHA51277624baf530a198eeb708b5d28cd536a8314101a23e8b9570699f35d4d962f47e1537ee283efb09eabaef4cf5c0523a9388d37a64f9e926c580028454d65d45f
-
Filesize
66KB
MD5789b642be64ab66b08b88301d09cda72
SHA1faf718e30daa13bdfee80744d68a271dacec136c
SHA2560c96edb27bc3201ea674867fc420352106b22839445e30298f84dc0c23c344d7
SHA51220fc7f6a029c0510c4e7c7a62dba25eb88b17526c6cf0c0fca4894208c8ca7f34fc92be91e23b249b861842936727a55f727ff89c4ba652aea67327210576968