a83dc3947ccdea789fa77a778c180fb315dd72dc686a62507ca73a790723f06a

Analysis

max time kernel
119s
max time network
65s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

489b34427f1d1617f27dcdb18231df30N.exe
Size

411KB
MD5

489b34427f1d1617f27dcdb18231df30
SHA1

4b1bcdd4054e042827ff93c05ad638c3b21ccef2
SHA256

a83dc3947ccdea789fa77a778c180fb315dd72dc686a62507ca73a790723f06a
SHA512

337b4740d896276e0cfde18faed210e03461a5691d0537112975cf5eae6754295a724cc4a16de38d388ddd762a5c7222f6f76d5385c11ac79ea223698d855708
SSDEEP

6144:XLZ/JdK0RsrJ3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKE:1/JjqwKhHSDeWTRW8fdebE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
696	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2168	Logo1_.exe
2016	489b34427f1d1617f27dcdb18231df30N.exe

Loads dropped DLL 1 IoCs

pid	Process
696	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	489b34427f1d1617f27dcdb18231df30N.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe
2168	Logo1_.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 696	1724	489b34427f1d1617f27dcdb18231df30N.exe	30
PID 1724 wrote to memory of 696	1724	489b34427f1d1617f27dcdb18231df30N.exe	30
PID 1724 wrote to memory of 696	1724	489b34427f1d1617f27dcdb18231df30N.exe	30
PID 1724 wrote to memory of 696	1724	489b34427f1d1617f27dcdb18231df30N.exe	30
PID 1724 wrote to memory of 2168	1724	489b34427f1d1617f27dcdb18231df30N.exe	31
PID 1724 wrote to memory of 2168	1724	489b34427f1d1617f27dcdb18231df30N.exe	31
PID 1724 wrote to memory of 2168	1724	489b34427f1d1617f27dcdb18231df30N.exe	31
PID 1724 wrote to memory of 2168	1724	489b34427f1d1617f27dcdb18231df30N.exe	31
PID 2168 wrote to memory of 2312	2168	Logo1_.exe	33
PID 2168 wrote to memory of 2312	2168	Logo1_.exe	33
PID 2168 wrote to memory of 2312	2168	Logo1_.exe	33
PID 2168 wrote to memory of 2312	2168	Logo1_.exe	33
PID 2312 wrote to memory of 2468	2312	net.exe	35
PID 2312 wrote to memory of 2468	2312	net.exe	35
PID 2312 wrote to memory of 2468	2312	net.exe	35
PID 2312 wrote to memory of 2468	2312	net.exe	35
PID 696 wrote to memory of 2016	696	cmd.exe	36
PID 696 wrote to memory of 2016	696	cmd.exe	36
PID 696 wrote to memory of 2016	696	cmd.exe	36
PID 696 wrote to memory of 2016	696	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\489b34427f1d1617f27dcdb18231df30N.exe
"C:\Users\Admin\AppData\Local\Temp\489b34427f1d1617f27dcdb18231df30N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$aAE97.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Users\Admin\AppData\Local\Temp\489b34427f1d1617f27dcdb18231df30N.exe
    "C:\Users\Admin\AppData\Local\Temp\489b34427f1d1617f27dcdb18231df30N.exe"
    3⤵
    - Executes dropped EXE
    PID:2016
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aAE97.bat

Filesize
536B

MD5
d0ab1c34e523691e59d09a4a9935d6fb

SHA1
0e81a40b6271e064d7c77f261a801e9b927cfbad

SHA256
7c05dae6f94d043867ad216b2d0f866422b3330355e67657602ec2fe2ef487c1

SHA512
9748f5b254efeb267780e23cbc57f043e0984cfe885bd1ad53f4e6f221ca6f076cd6534f48cfe039132a06b9fdb641b51fa672194a8527c23e017cd5f5454b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\489b34427f1d1617f27dcdb18231df30N.exe.exe

Filesize
345KB

MD5
6623abd95d6ca5b4e9d78570d1e531ad

SHA1
dd734ce4057e98af82197af22a436b3ae05e1af9

SHA256
db197e4e2d60b8161a5cf5c41a9d3d1d5cc694c19fe96d71e33747dd20c1d4b3

SHA512
77624baf530a198eeb708b5d28cd536a8314101a23e8b9570699f35d4d962f47e1537ee283efb09eabaef4cf5c0523a9388d37a64f9e926c580028454d65d45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC4F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC62.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Logo1_.exe

Filesize
66KB

MD5
9489ba70ef0f9bfa69ec3a793b5b5387

SHA1
9fac7e42cb96b825ec1b0e4eec39ff23506efb4b

SHA256
8a40ccad0bedf960ec09b5a428767e471354cc6a06c50613670a6fbf862bfa84

SHA512
976d522c5e355ba8138fb58adbac4632bf9bb84a441c8f071e20ce875e0ac1ba39419fbd68e4691f2308c9d5786623674738b0052b6743ea05a038a8ac90c088

Download Submit
memory/1724-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-238-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-239-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-241-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-247-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-249-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-380-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2168-381-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download