1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Size

1019KB
MD5

5bbc6945a17157f1c599b98ec10b355f
SHA1

fa74daf9bbe2c1934b955fb2d2bfe438053f518e
SHA256

1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0
SHA512

0498864f9091e546007e5d122ed0103c82246dd10446c3f2b47a7f5f7e5f889f4056e1927b74936635e95be6eb96526eb2bb0542c7f751d25b54cfce6b562dfd
SSDEEP

24576:comUFhNcmLFj4svqaShRsUiTfjo5ya8j8k:cCGmxj4svqaShRibza8T

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4460	Logo1_.exe
4808	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
File created	C:\Windows\Logo1_.exe	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe
4460	Logo1_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 452	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	83
PID 1524 wrote to memory of 452	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	83
PID 1524 wrote to memory of 452	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	83
PID 1524 wrote to memory of 4460	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	84
PID 1524 wrote to memory of 4460	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	84
PID 1524 wrote to memory of 4460	1524	1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe	84
PID 4460 wrote to memory of 4024	4460	Logo1_.exe	87
PID 4460 wrote to memory of 4024	4460	Logo1_.exe	87
PID 4460 wrote to memory of 4024	4460	Logo1_.exe	87
PID 4024 wrote to memory of 4168	4024	net.exe	89
PID 4024 wrote to memory of 4168	4024	net.exe	89
PID 4024 wrote to memory of 4168	4024	net.exe	89
PID 452 wrote to memory of 4808	452	cmd.exe	90
PID 452 wrote to memory of 4808	452	cmd.exe	90
PID 4460 wrote to memory of 3256	4460	Logo1_.exe	55
PID 4460 wrote to memory of 3256	4460	Logo1_.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
  "C:\Users\Admin\AppData\Local\Temp\1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8424.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe
      "C:\Users\Admin\AppData\Local\Temp\1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4808
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

Filesize
247KB

MD5
3b7323809d41550af758af9000ff3092

SHA1
e9303c0bb8533e7b075a46a43518db6dc96a92fd

SHA256
407a2f7f67658e3d53ba493282c381128064b57959e1e6163ffe43c8263ab73d

SHA512
6a5ab7c5604a3faa5e5a99a4235b2883a69add3a180acdd2e99607a9f0bbbdc2d7420aca1baacb929e6fb0f953ef55268ee3034b67053c83cf8a991f92d4b221

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
573KB

MD5
8b91687d5fca693e8c9944e29d141e05

SHA1
5bbca3b5b9f53d43093b36a8286e42a8ca9f695e

SHA256
26cf174a36e7f906d641953a1b187fcd9ec03d867b5ac5ba49a35641d026149c

SHA512
0bb6bd176510f6cf62f2d5104dcaabd348ad782b89233c7ef7cc7014a1faf70d431944400bda8400b34cf116e96660954a483b1eeb669b0d5a9f36f3c457773e

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
639KB

MD5
2282a1c1dd5900e35b3cf33f6394ac04

SHA1
0eaf304634e4a42012d5dbc8013eb0ee41f76bb4

SHA256
c12c59b4c31a46e116c57085594023e89d84935ca59c895a188d6a9d4d27b5da

SHA512
619d756a7c43b10c825bdcffca6f3eea42feaaeeca731c781d6ba0b9095bb925b1bd40855d7ea60e93139cb8d09e0ebdd0e915c66e4a39f78169fe3dae3fbc69

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a8424.bat

Filesize
722B

MD5
0b4ef6fcb91e6ac1580247c0f7a4d367

SHA1
e45806ab837f2f2abca9a4db6a6ca7ba974a4c37

SHA256
f2d0983ed0ae8e528bbbe3f6dae5c9a2ccebf5037cd11ba54440629f492a5425

SHA512
8d5b90c55c732b8a66a6b9be81af8afef6ed4beed25c519bf4415250a3adcb0f36f7f6a6d7384783d62693bfbefd67c9d7908811dbadba23c70fa0515eaa33ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1039f1f87ca63acec4ab781e75bea9704a16e3c5e2bcbfe1dd9e7807f309aaa0.exe.exe

Filesize
990KB

MD5
0c45b1af9f410771bfd1740f40dc4173

SHA1
b896091855905e152abf260a64ebdf8b0c38aeb4

SHA256
3f1a80889fc13d98a26b8b6ac034d8ff4a04a5e3fe6c41c994585f5ba3e32bb2

SHA512
b23e2cb50ed312cb261df84a87283520079cd479ca16c19079abfce4f5ea18cbc730a191af480431f99d5a062e4b853745140d5e9d40003395f16b5867a11d5e

Download Submit
C:\Windows\Logo1_.exe

Filesize
29KB

MD5
2c2a254f4ac4becff7c1ed95d1dfc193

SHA1
832200e5634e50357289652ac22084ef08089309

SHA256
33bef330eba567c27023e923fc3691905f377e95b42999689e93a892f64fa369

SHA512
f8ebfadfb39b23bdb76e3403a7d55f8dd19e64f21f81642b3fa5bdfad278e0acc79682a05edaa8d7438aa2240a9a00cc8f615edee27a86b23db9d5ae5f69657d

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\_desktop.ini

Filesize
8B

MD5
0eba530c95ed92c62635372036e559bf

SHA1
d24bedd9e198e4f71f8e9d0dc36351d486609337

SHA256
fdac71b01088c649a174d112f28b274807c720c98d39c8ea678b0832f8cd4b39

SHA512
7bf606115d882198ab92ff5d7f9f92f83e2e8bb4c2be9601ace2de9d7613938a56ffd51331ae22ff62b47fcc8bb54e9007a0375348a4a37b3b82e59d8ca1f3b1

Download Submit
memory/1524-10-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1524-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-27-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-1234-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-20-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-4786-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4460-5231-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download