512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
Size

70KB
MD5

892772aa0331b21a22e480928647f38f
SHA1

eb0aa18bd65f530c866b32962436a9993d4fca57
SHA256

512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3
SHA512

19ed9aa4c06759824f8cdfc36b5843f05baffbb1cd8463a219030551304a4a212700c31fda7c7180b40c056aa572dff13f4cc176b3dcf5702fd98652bf57946a
SSDEEP

1536:ps3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pskuJVLtlZQKbgZi1St7xQ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2492	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2052	Logo1_.exe
2504	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
File created	C:\Windows\Logo1_.exe	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe
2052	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2492	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	30
PID 2332 wrote to memory of 2492	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	30
PID 2332 wrote to memory of 2492	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	30
PID 2332 wrote to memory of 2492	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	30
PID 2332 wrote to memory of 2052	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	31
PID 2332 wrote to memory of 2052	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	31
PID 2332 wrote to memory of 2052	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	31
PID 2332 wrote to memory of 2052	2332	512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe	31
PID 2492 wrote to memory of 2504	2492	cmd.exe	34
PID 2492 wrote to memory of 2504	2492	cmd.exe	34
PID 2492 wrote to memory of 2504	2492	cmd.exe	34
PID 2492 wrote to memory of 2504	2492	cmd.exe	34
PID 2052 wrote to memory of 2000	2052	Logo1_.exe	33
PID 2052 wrote to memory of 2000	2052	Logo1_.exe	33
PID 2052 wrote to memory of 2000	2052	Logo1_.exe	33
PID 2052 wrote to memory of 2000	2052	Logo1_.exe	33
PID 2000 wrote to memory of 2268	2000	net.exe	36
PID 2000 wrote to memory of 2268	2000	net.exe	36
PID 2000 wrote to memory of 2268	2000	net.exe	36
PID 2000 wrote to memory of 2268	2000	net.exe	36
PID 2052 wrote to memory of 1204	2052	Logo1_.exe	21
PID 2052 wrote to memory of 1204	2052	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
  "C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aBF78.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
      "C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"
      4⤵
      Executes dropped EXE
      PID:2504
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
254KB

MD5
c420c4af538b11e5654382b1b95c1f74

SHA1
b9c6a3a3f463948c25e162214d064039eb394b1b

SHA256
1605b0cd978c5eea742ac6c780774a1c921791a0b8efb5a4df0ef8243db956ce

SHA512
094687162f991b97ebc4a6b9f9bf0de05631ddde6fbec11595948c7c3ebdd1dd4e3d34bddd470beee8614d6c9533c394b4c700664ce0c41ee52df6e192bc1526

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
2faaad87f08521fcc8daee0d433d478b

SHA1
a75b87049a6c122b921f66cddeabb12502857a2f

SHA256
70546de82df8bdbcd9022e1bd74a8f50d61dd19532aeaa32a69582acda025b25

SHA512
1dff24a69a25f323075c8553c643c1b5bbe83a5c6d975467dabd6027ff48d0c9d0cd06ecdbf6b6a5f97a060e0353eb31898d66a9e1adcc5497e05bac06566f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aBF78.bat

Filesize
722B

MD5
9905f1007510a4eea8ff5dea0fbbd5d7

SHA1
ea45884fd8709bb69a08079e0b51a2627f225098

SHA256
d86913a0c2c0618fa501d1055f177868c8eead8b04846b4d9a5645313c099559

SHA512
fdf4b075d8e6edf68e713084ebc972eb0edb2588212687fe9bb0e56b09f33169438bcb4890999419022c8ba14eeb2db6dd363999c70f0898a6e2376ccdd21c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe.exe

Filesize
41KB

MD5
977e405c109268909fd24a94cc23d4f0

SHA1
af5d032c2b6caa2164cf298e95b09060665c4188

SHA256
cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f

SHA512
12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
5b4c3134de39fdc610b472ca6e113242

SHA1
7941f97bab57022193bad8718a864b72c55eefc9

SHA256
cd8cbf6357454d633657c471e6ef57a5cbeadb7df75d37d8ebe93e0097967a6c

SHA512
717ba94652d293686833b1f4a759826d54cac51498fabbfaff240c1c9959d9deea38f277537c604d21ad70e8237fec0cf769bb5adcb4bc52e5ade69efbddab86

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1385883288-3042840365-2734249351-1000\_desktop.ini

Filesize
9B

MD5
1368e4d784ef82633de86fa6bc6e37f9

SHA1
77c7384e886b27647bb4f2fd364e7947e7b6abc6

SHA256
57507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772

SHA512
3cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b

Download Submit
memory/1204-29-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/2052-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-641-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-1873-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-2317-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-3333-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2332-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2332-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download