Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28896d0690948dee049186bfac97b470N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
28896d0690948dee049186bfac97b470N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
28896d0690948dee049186bfac97b470N.exe
-
Size
95KB
-
MD5
28896d0690948dee049186bfac97b470
-
SHA1
ac3a53315db76824c93829d5d29f173e2611830e
-
SHA256
c34db677852953ef30e2b76c17eccd5f77a9d3edf0086068f1ffe0cce7bfe820
-
SHA512
be1c990a83bbcc95f4c27017c1ceef22116f7b44ac2929fda3c494db01419c24d0a299441f319013df241947b7c4f4e18658e94eee57659e784589717c1d35e7
-
SSDEEP
1536:xjMqxL2Q3qOLjp01Y06JdOGZqlSmQBDtkDCr5EDZvX/xsJ:xAyLd0K/JdOStX5EDUJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2156 Logo1_.exe 4376 28896d0690948dee049186bfac97b470N.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86328\java.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\Logo1_.exe 28896d0690948dee049186bfac97b470N.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe 2156 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4304 wrote to memory of 964 4304 28896d0690948dee049186bfac97b470N.exe 84 PID 4304 wrote to memory of 964 4304 28896d0690948dee049186bfac97b470N.exe 84 PID 4304 wrote to memory of 964 4304 28896d0690948dee049186bfac97b470N.exe 84 PID 4304 wrote to memory of 2156 4304 28896d0690948dee049186bfac97b470N.exe 85 PID 4304 wrote to memory of 2156 4304 28896d0690948dee049186bfac97b470N.exe 85 PID 4304 wrote to memory of 2156 4304 28896d0690948dee049186bfac97b470N.exe 85 PID 2156 wrote to memory of 4892 2156 Logo1_.exe 87 PID 2156 wrote to memory of 4892 2156 Logo1_.exe 87 PID 2156 wrote to memory of 4892 2156 Logo1_.exe 87 PID 4892 wrote to memory of 5052 4892 net.exe 89 PID 4892 wrote to memory of 5052 4892 net.exe 89 PID 4892 wrote to memory of 5052 4892 net.exe 89 PID 964 wrote to memory of 4376 964 cmd.exe 90 PID 964 wrote to memory of 4376 964 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\28896d0690948dee049186bfac97b470N.exe"C:\Users\Admin\AppData\Local\Temp\28896d0690948dee049186bfac97b470N.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB229.bat2⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\28896d0690948dee049186bfac97b470N.exe"C:\Users\Admin\AppData\Local\Temp\28896d0690948dee049186bfac97b470N.exe"3⤵
- Executes dropped EXE
PID:4376
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5052
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
750KB
MD52ed5066bb06249a3a866b05150937238
SHA1ecf699b03431291a2caeeab3d19a42daac6c8f9b
SHA2565671ee7d070168cc2238dd771756175e7bb9fb60d7c0f2f32c6c85988a45fbac
SHA5126132363918290e912290854808ae1ecefc07d10f04445f28376bd29de8a97a753afab69192ffc10164a5ec9c8d34805d9171b715d3e279b63ba223abee0fa08f
-
Filesize
536B
MD5c53b691b89bb344971cdf582e1a5f83d
SHA160490d38928816a0d31dea13c1a5915a8f2bdfeb
SHA25636e2b0b1dbd235ffe785081de846d41100dd2d023a4369a2ff5ceb295ac7d667
SHA51210b5ca387d79fd9fe551850723a097656cace87a054e90fabce991e5c1682e3cc1dbfd5423deb5010617509c5336d71f63e62b3ae1b8d33fb687eff877599faa
-
Filesize
29KB
MD5aa8be4a43d0ca0cc8f43405e2aa2b137
SHA1f01c2dc35441ca3daeb79f165d76f422582ceb66
SHA256e605e6b5701a525db7001f65ebfd314abba4ad9414e478e923b3a697cf06bc77
SHA51212cbf68aadcd45ecd84b700b6b0c7d836fcc6ac54b97b942b1a86f470a49a3acb77f464288ca8a6a22409ed209c48bd5479149e15fc8feb1b11386518a5cacd5
-
Filesize
66KB
MD5f0f079c7d04db77b32f96165a44aece1
SHA161d1fdc1d988a9b0f2e8399f84240ff5c47bb384
SHA2563b9ba52ffc0e1e20761eeb921e9c046250723c132504ceed1146d378e5f19b4f
SHA512c1ffee86f2a22ebe857652943ba474cf4777d8e143484e0fd025f457cf27af7d84aec61ffe976942af483d1e9ea5dbcd8b4e6831603fbdad5b709b325ff7180e