Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
Resource
win10v2004-20240802-en
General
-
Target
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
-
Size
364KB
-
MD5
25dd2deac477c00307be4e35fe36d16a
-
SHA1
6cbf31d3f76282c7bebf245608cf52857fbe4b0d
-
SHA256
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40
-
SHA512
e5a545859036dd3617cfc013d72e4d267d3a9c4e303d0fa7c7010c34b0e97266c88549f3f0e2a0de4aa1194be21927084571cd8492dd0258227107aef40ee69f
-
SSDEEP
6144:tCuJPzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:1U66b5zhVymA/XSRh
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1740 Logo1_.exe 3912 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ta-IN\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe File created C:\Windows\Logo1_.exe fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe 1740 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3492 wrote to memory of 2444 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 86 PID 3492 wrote to memory of 2444 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 86 PID 3492 wrote to memory of 2444 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 86 PID 3492 wrote to memory of 1740 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 87 PID 3492 wrote to memory of 1740 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 87 PID 3492 wrote to memory of 1740 3492 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 87 PID 1740 wrote to memory of 4948 1740 Logo1_.exe 89 PID 1740 wrote to memory of 4948 1740 Logo1_.exe 89 PID 1740 wrote to memory of 4948 1740 Logo1_.exe 89 PID 4948 wrote to memory of 3628 4948 net.exe 91 PID 4948 wrote to memory of 3628 4948 net.exe 91 PID 4948 wrote to memory of 3628 4948 net.exe 91 PID 2444 wrote to memory of 3912 2444 cmd.exe 92 PID 2444 wrote to memory of 3912 2444 cmd.exe 92 PID 1740 wrote to memory of 3408 1740 Logo1_.exe 56 PID 1740 wrote to memory of 3408 1740 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CA4.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"4⤵
- Executes dropped EXE
PID:3912
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:3628
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD51850c36bb884826d2fb21c400c7e9485
SHA1c23038eef67d666b0fabba505dbaf88445b1bbfb
SHA256e072ed58a2f44693d50048a1c04e31f871f37131efa1f2609358feefe884eec0
SHA512ebaaf5a0eb9595a5928e2ecfce87170dcab455c4874dd786641d282dcc1fb7d80dfc4c285718f5cb6748b42e5c91e14ea4be6865255dca18f06f9f0d750d0585
-
Filesize
573KB
MD528dc566a26d9daf7acc0de09b86489b4
SHA1d750d48fd430cf173b6c84fd25ab924c8ca720ed
SHA256b6b051b07a1c2c909e4dc7e9139a77a86defdddf6c19219d165155026d1a8abc
SHA512a19d87e4a3de8b846d675a056b2f83eff4a27882d51db49b40f4dc8113ea8ce148d38dbe6c868c71716da0001d1d4f6445f61ee67096844261d9c0984e35bde1
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize639KB
MD5c8d281da4c32df16eef470c27c8cb459
SHA100efc9f6844bfaa37c264b6452c6a7356638ab10
SHA256058c81e5a07f2c6c33cf28dff71d07ad8f179046108d945159957e891bfd9c62
SHA512e3c79e19f620068f668d4ebaa5097f1a95a30dabb8dce75f3787171dddbea9f684fc7ce8d1011a398f38084d7af96dd1ff9a02d25906aab9b13861b8363d24bb
-
Filesize
722B
MD552d93d56d505e3b515b2fe6035cdc387
SHA1b1114a06019e2137133579e46d7c7d4bebc62012
SHA256101a24cb447ca3816e13ab9cd6a4189ea4070148187df52c976cbdd33ce3b277
SHA51279ccefd6c0726718ed85044093df8e1bee31de7904c7543621adea25d083ca2b2a630d0852a69b522b4971bd539c9cf4db34c79376c1872a4f0a6b3d256e6a86
-
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe.exe
Filesize335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
Filesize
29KB
MD5c64b5702b462a9345363255cd38a3788
SHA19b6b6e857e544e61ee783065926c92d48337f0ce
SHA25616c685475090f9e09f57bb8836c127fb02a08926f76779de941fad5d6305f825
SHA51226c0c862561e1521891ee018bec7e128578343b2bc0e3471b87c5ef536e235c7ac9665c3ba84f9e0b9b206d3fae859ebefb1fd373123e0ee31b670e9bbe73836
-
Filesize
8B
MD5fcbaf0a2c3988ef775359f94d545ab42
SHA1174ccd98ff87b8e6f46eebc493f379beafeb3b08
SHA256895aaa8dac57f2bb76ddc8c2681e0480bf57dbf3f62cda3840cb448b8615612f
SHA5127c81b6445708b1c482599bfb808e90462d6111e885691dd947d9cdf95ba028d580b20027575814a310a81f310261b649792b65153ce43063da063b5005561d20