bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
Size

398KB
MD5

ca4eef83512d0a2704a0146c7dcc8a92
SHA1

bb6b28582da7a1661fdbb0ec026b2c2919fd84ba
SHA256

bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7
SHA512

362457b3a2d89015ec34a181af95442eed8eb43ff6ebe4e8b66a38c36c01991af62c84b7494c936d85cf031548e5ae1aafba55ea8b67a8955aabea64c20e2372
SSDEEP

12288:x7+iY+evpFV5DJhzAtUskJ0eZHQ2ksAKNeiQ30blG:x76HVnkszNerEk

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1792	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2236	Logo1_.exe
2748	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe

Loads dropped DLL 2 IoCs

pid	Process
1792	cmd.exe
1792	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DAO\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\fr-FR\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
File created	C:\Windows\Logo1_.exe	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe
2236	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1792	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	30
PID 2544 wrote to memory of 1792	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	30
PID 2544 wrote to memory of 1792	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	30
PID 2544 wrote to memory of 1792	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	30
PID 2544 wrote to memory of 2236	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	31
PID 2544 wrote to memory of 2236	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	31
PID 2544 wrote to memory of 2236	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	31
PID 2544 wrote to memory of 2236	2544	bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe	31
PID 2236 wrote to memory of 2756	2236	Logo1_.exe	33
PID 2236 wrote to memory of 2756	2236	Logo1_.exe	33
PID 2236 wrote to memory of 2756	2236	Logo1_.exe	33
PID 2236 wrote to memory of 2756	2236	Logo1_.exe	33
PID 2756 wrote to memory of 2768	2756	net.exe	35
PID 2756 wrote to memory of 2768	2756	net.exe	35
PID 2756 wrote to memory of 2768	2756	net.exe	35
PID 2756 wrote to memory of 2768	2756	net.exe	35
PID 1792 wrote to memory of 2748	1792	cmd.exe	36
PID 1792 wrote to memory of 2748	1792	cmd.exe	36
PID 1792 wrote to memory of 2748	1792	cmd.exe	36
PID 1792 wrote to memory of 2748	1792	cmd.exe	36
PID 2236 wrote to memory of 1188	2236	Logo1_.exe	21
PID 2236 wrote to memory of 1188	2236	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
  "C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a98F5.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
      "C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2748
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
3f9d951f006c9e4eb9951ce307b1154b

SHA1
b28c6e9e4d8fe8ff3c5c386d7046f1c1287f6d56

SHA256
1c3c896c3005c00cca13630a5e1c42da1f486be098cf7b24bf04b91c1285c564

SHA512
11e163e794a3542b98a5e8cb7903dbd5880f79a812502319f07a279ac3a6bb3cce5d20b6e32dbce81e290c0a0d57ad085a2db80622677c3827324fb7c9c987ee

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a98F5.bat

Filesize
722B

MD5
76d472f2865dc5d2630ba885b69ab814

SHA1
65930959cd7edd96c994d28c59b6bbbd384d1732

SHA256
db4f98c17423b6915c16b63ca9560709acdfbcd69027cbf0f1bb40efda2f77bd

SHA512
6aefe1636d56c4966a755400383ca59d75cc50e13ffd46c89b8767b44efcfca2db7b256cf6724f6f957075a85ffe6542712c43f7a03172a11f5fbcc536f671c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe.exe

Filesize
372KB

MD5
6da7293f38e94cb996573701b304c023

SHA1
1138423f6c20051813861da57dbd1d801d45a1a9

SHA256
e08a1fd51eb282da8bb1d62f441b9dc1c908dfe48681a53340b0bf4dab2dcd7a

SHA512
4642994096d39f226ffa5c9a5d53b8b82fdf507dffe2f23573e4c96b76d5893416e7741245f43cb96e2f1e59b0829b2b81c5bb19caefd1bb3de49ec4821fe407

Download Submit
C:\Windows\rundl132.exe

Filesize
26KB

MD5
299f200b35bb4d4b2806d2126f9adaf0

SHA1
d79612590eabd0b56be89ac3df76ff2070e44681

SHA256
6f659314234895b3f36d86958d115025e5151bb5f3eb05a7c86a91aa15a3fa82

SHA512
5c40e2692cbe3b33f27d8281a4fc5d1069de84964cdae28d6986145e39d66be9751eee147874ab359768e3d33a58053b4ef8ff90fb63326131555d8c3ae58eb8

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\_desktop.ini

Filesize
9B

MD5
26a799e5457b5e8836d7b58e5787f437

SHA1
7dc33652947afbe41d930e2a928dbd2f2e23e983

SHA256
a6038a34fb7a4cafee0fabca96d108d7ffbb35832abfa12290467dea3360e00f

SHA512
03d1a024d878a4021e38dfda03c8b8941640dd7f580a85b9045c1b421df3c32925d1bd9d3818983eb4987a6ac18fb88d368f7f712a9095a089657299c233095e

Download Submit
memory/1188-31-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2236-99-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-93-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-765-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-1877-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-2940-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-3337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2544-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2544-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download