91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
Size

573KB
MD5

e85a10cf1c849dcccee64a8c51ed7d67
SHA1

38a2dc2635d8362ccf5b28d2f1204011bf226d84
SHA256

91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc
SHA512

50104c7ae5e0fae75aaa755e1edf51fa306ac290ab3ad9e9829d160d8ac6123a0d81408b60143d363dedbaba8f97861513b3a0f82743ea375be0b94529eeed03
SSDEEP

6144:DuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:l7a3iwbihym2g7XO3LWUQfh4Co

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2012	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
3060	Logo1_.exe
2272	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Portable Devices\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
File created	C:\Windows\Logo1_.exe	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe
3060	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2012	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	30
PID 2312 wrote to memory of 2012	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	30
PID 2312 wrote to memory of 2012	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	30
PID 2312 wrote to memory of 2012	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	30
PID 2312 wrote to memory of 3060	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	31
PID 2312 wrote to memory of 3060	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	31
PID 2312 wrote to memory of 3060	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	31
PID 2312 wrote to memory of 3060	2312	91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe	31
PID 3060 wrote to memory of 3044	3060	Logo1_.exe	32
PID 3060 wrote to memory of 3044	3060	Logo1_.exe	32
PID 3060 wrote to memory of 3044	3060	Logo1_.exe	32
PID 3060 wrote to memory of 3044	3060	Logo1_.exe	32
PID 3044 wrote to memory of 2648	3044	net.exe	35
PID 3044 wrote to memory of 2648	3044	net.exe	35
PID 3044 wrote to memory of 2648	3044	net.exe	35
PID 3044 wrote to memory of 2648	3044	net.exe	35
PID 2012 wrote to memory of 2272	2012	cmd.exe	36
PID 2012 wrote to memory of 2272	2012	cmd.exe	36
PID 2012 wrote to memory of 2272	2012	cmd.exe	36
PID 2012 wrote to memory of 2272	2012	cmd.exe	36
PID 3060 wrote to memory of 1196	3060	Logo1_.exe	21
PID 3060 wrote to memory of 1196	3060	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
  "C:\Users\Admin\AppData\Local\Temp\91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA0B2.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe
      "C:\Users\Admin\AppData\Local\Temp\91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe"
      4⤵
      Executes dropped EXE
      PID:2272
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
474KB

MD5
1b12b9060b8875ff79fd921d924df171

SHA1
2cefdd8b0ba05d21051feb64909fef80f4d4f799

SHA256
b4e50274be3a43611ffaa568b252b827c66855f4f50024b31ac68712cdb4eaba

SHA512
26c4d288eb0525f4abaa9fa9704aabd30b21d0dc444a4d352edc92ca584b384c00dc16c3ba9b904ba9cf8718a0e51501e505873d5b09cfc76013eb8f5e5f393a

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$aA0B2.bat

Filesize
722B

MD5
a4b92407cd4fce1b78481c3f379aa0e4

SHA1
b52e71b96a5a7573092ea9344a19e0a31e52a181

SHA256
6dd9503e3aed52dfe5479161d2933e7c70e6600ec2494894c0e43639015e83a4

SHA512
583c6af3ca89c457855129a584a40b84c005de5857327be63b5f852ff939d5ca78548b861dda0c7f5d3d3fb694a53ebb68ca7132698a44a6ddc63f4e0291b663

Download Submit
C:\Users\Admin\AppData\Local\Temp\91b929017e801c95d048133c80f0f22907aa4531732155300551e786d25485bc.exe.exe

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Windows\rundl132.exe

Filesize
29KB

MD5
7df4cd4ea9e18ac4eac10b27f9b1befc

SHA1
cf3502a223bd7ad9f15dc01f765bdc55304b228d

SHA256
d3a2638f1ce0bfb967235ed43cb85a5d429a462d5231af8abee7219f7b8b3ae3

SHA512
e7f8467655f3eab4aedbc933740a502ad95525007c27cd0ab923c8a65ce7419fdf895070e593dc5851641bc256b6881dbb728520be892f1b96a6ccd525c8bf33

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3294248377-1418901787-4083263181-1000\_desktop.ini

Filesize
8B

MD5
34f94fcbc939d25f54e986fe97a87522

SHA1
dcde2a11c5631b5dbd93ce97e503d0ff42a6f341

SHA256
47f454cb045cab0f9ee28683942faddf984b88986cb761e4caa639f91ac4cdd7

SHA512
aad5abbdc495f19e0997d67d3daad417eb18f3e3061de2515d3870cc6c2c417aef366de938c8c98d3b62b81ec44f5a16e1227118e28b4624c99b2c1546e1c678

Download Submit
memory/1196-29-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/2312-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2312-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-870-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-1873-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-3082-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-3333-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3060-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download