Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 10:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe
-
Size
377KB
-
MD5
bb1e6d83797352e7f2a27435cb5877f3
-
SHA1
1eedd711a0b3fe125de7693be800f8f39434dbb0
-
SHA256
430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458
-
SHA512
610bf07cc739e30311440694960148d0a10433e7d183c3d65ac28259d72a37bfe274f365ad2fbaf50e5840a1d694846b7809310f95866af0efef589733a2053e
-
SSDEEP
6144:Fyj93w/CH9L5d5ezLqIFQSDdABbSbIrx1L1l3ERF:FyjiCH9Eq+0BbSox1QF
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4800 Logo1_.exe 3336 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe File created C:\Windows\Logo1_.exe 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 744 4800 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe 4800 Logo1_.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3336 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2052 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 83 PID 1916 wrote to memory of 2052 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 83 PID 1916 wrote to memory of 2052 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 83 PID 1916 wrote to memory of 4800 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 85 PID 1916 wrote to memory of 4800 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 85 PID 1916 wrote to memory of 4800 1916 430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe 85 PID 4800 wrote to memory of 964 4800 Logo1_.exe 87 PID 4800 wrote to memory of 964 4800 Logo1_.exe 87 PID 4800 wrote to memory of 964 4800 Logo1_.exe 87 PID 964 wrote to memory of 2656 964 net.exe 89 PID 964 wrote to memory of 2656 964 net.exe 89 PID 964 wrote to memory of 2656 964 net.exe 89 PID 2052 wrote to memory of 3336 2052 cmd.exe 90 PID 2052 wrote to memory of 3336 2052 cmd.exe 90 PID 2052 wrote to memory of 3336 2052 cmd.exe 90 PID 4800 wrote to memory of 3576 4800 Logo1_.exe 56 PID 4800 wrote to memory of 3576 4800 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe"C:\Users\Admin\AppData\Local\Temp\430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D1.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe"C:\Users\Admin\AppData\Local\Temp\430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 7164⤵
- Program crash
PID:744
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 48001⤵PID:4384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5f9ed31b5351c4c17d29ad19af0abdd13
SHA1a7d709455782b0eed5d180c0dd219e0b1186ded1
SHA2567ae2826c96cd8c479c35111252d164cc935a544783d24f3f1443d3c924334ac2
SHA512aee5982f9cd51610a67db3a17cbc66e25ec817645eafe7eb331c3844f761c08634870bbd95d05b9c322df513fcc0f4c00b70a7635e9699e0297fd556971bbe03
-
Filesize
722B
MD581a941b407ef7089528fa90406c75bcd
SHA1c70acefdb49e5911b5b45794d9a11f1b157f55c6
SHA2566f067c018e4ea47abefb20ddc99c5f16d0fd55e6ecaf181d23eba71a1fabc6ec
SHA5127e4d74f9b6d11e543ec831f8cb353c33ca2501213641d8dae383d713d109a2e24a6969ed687f11d7ffd25496e61f05a304eb4a982dc4a66fd0453fd47186072f
-
C:\Users\Admin\AppData\Local\Temp\430dee31fbca1c16b9c629fe7b31896af4a141429adec5f8160e9ae3040b3458.exe.exe
Filesize333KB
MD5e5b38b9828293047f0352f7a38a22fb1
SHA1681311628ac93f84371b2a069fa220dc89a3f672
SHA256b85aeeaede189d9f56c843281a492cd8ada329f0b5b8b03d5a813eba3a290b61
SHA512ed3e369451b938a556fb561afd6fd3ff5cfc93e386b035014fd4824a808f1e92e6d095ab33c340e6cd64ee00122fbd882abbcf0e15f3ffdb29a4fb9febe42920
-
Filesize
44KB
MD5b4bd6d8748d30cf88bbe6f3ecdd8cac2
SHA19b55a70bf253f3fcf14931204784d364becf2bc7
SHA2568681a70f5484648f954b5b8ea03e3e35ada252e9e73540f10f53ebb845b68b58
SHA51294a553f4435ec5715e8d65a7555d8721262563443fed099bc4d550e98a6100773e81fc0421bfdcaa2c32884ca6060c55121d512ec5a94ff590de4c8d6cb4fe5e
-
Filesize
8B
MD5b3317f5683e250dbd6c0e382ce3bc97c
SHA184261260605717b15275902ca71eb5eea0d2a423
SHA25601f7156c49e1dbb12c8503de3ddac5a37005bd3ad103341a60a830f4b361bd5a
SHA512537b27b08eba3b7d9262b43fc979a9642acd60d8970b9da936cebea873ec0ae851bdefc421c955d3ed9e1fbcc1cbb5669d9b848d5767d1119fc4ed2addf4710c