Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe
Resource
win10v2004-20240802-en
General
-
Target
13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe
-
Size
1.1MB
-
MD5
1ec3aacd70ffb14f3431a57abacb988b
-
SHA1
63df42986534930ba0c24c539caa0c5be4d39f4a
-
SHA256
13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d
-
SHA512
633c9ecc1d5213b1e01249a67cca3e530db44b21147a47ba87d8bc7985265b28778f5426d11e105fb0a1dbef94bd386fa2f71a6f669ae51cf92d979d08ddc7ce
-
SSDEEP
24576:Wf9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:W+GtCi27mVHyT+a0s
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2052 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1760 Logo1_.exe 2864 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe -
Loads dropped DLL 1 IoCs
pid Process 2052 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\Templates\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe File created C:\Windows\Logo1_.exe 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe 1760 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2052 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 30 PID 2056 wrote to memory of 2052 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 30 PID 2056 wrote to memory of 2052 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 30 PID 2056 wrote to memory of 2052 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 30 PID 2056 wrote to memory of 1760 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 31 PID 2056 wrote to memory of 1760 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 31 PID 2056 wrote to memory of 1760 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 31 PID 2056 wrote to memory of 1760 2056 13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe 31 PID 1760 wrote to memory of 2904 1760 Logo1_.exe 32 PID 1760 wrote to memory of 2904 1760 Logo1_.exe 32 PID 1760 wrote to memory of 2904 1760 Logo1_.exe 32 PID 1760 wrote to memory of 2904 1760 Logo1_.exe 32 PID 2904 wrote to memory of 2824 2904 net.exe 35 PID 2904 wrote to memory of 2824 2904 net.exe 35 PID 2904 wrote to memory of 2824 2904 net.exe 35 PID 2904 wrote to memory of 2824 2904 net.exe 35 PID 2052 wrote to memory of 2864 2052 cmd.exe 36 PID 2052 wrote to memory of 2864 2052 cmd.exe 36 PID 2052 wrote to memory of 2864 2052 cmd.exe 36 PID 2052 wrote to memory of 2864 2052 cmd.exe 36 PID 1760 wrote to memory of 1196 1760 Logo1_.exe 21 PID 1760 wrote to memory of 1196 1760 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aA14E.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"4⤵
- Executes dropped EXE
PID:2864
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD50e96df2b803787ad87d98fb164a286f5
SHA10790c9a340015c2e2ebbd5459c90b82cf6ae5f3a
SHA2568951711f84a55417c6e4f31b004f415a75abe8b26696751f840fcc8e928b9a8e
SHA5125fcc84cd18c7f9927e200ba37cc5ecf8d877736c3b14bc95d23aa734e9257db9b40a154cedcc56f1f3222f8153f93ca45ee2307315cfe3a14430a6c77d06501e
-
Filesize
474KB
MD52d816096dcd7a9b38e9b445b75c019a1
SHA1e3c192f07e460078a7b2db4aeb94d4c53700bd75
SHA25643b6be2e758c7e161993e451ce005a00345b4f3ba8b3c069d55ce93ac7e19758
SHA5126af3ed08658c195072f549af50b96cd05e8070bf468add1884caba811145e88e28ff016298ea52078d7d31bded223c12bf6ca294219610ba2a5036dd442d356c
-
Filesize
722B
MD5b711b4fa62645564a7f63fc7d096f49c
SHA15a1e7b89b48034efaaef345f448b980c6c9f6bba
SHA25669c35c28f8ce0709b33b6c58b6e21a4533a0b2d17a652268ae80c6a402e1283e
SHA512fe05c542575fff2fce9a1d1419110d5691c04576a0854f412d838e953675bae18d95f18412fd8295480a3593fbf4f2766a79471cd2b9faa39ba8cf9956f4b111
-
C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe.exe
Filesize1.1MB
MD509239e688ff75cd636ac932100b243f9
SHA12a7964c81b9a34bb77c4e3676e7d31b7d2668297
SHA256a36ef4c18a08ee8d8c0d10d96ab37a0c3ce22a8f328733af8c0451579e4edcb1
SHA512686708321d8756ddcfa2d1585ca7261be0ece33bd9d134888cdb4655b8484c727b34b4ac7f12d919184e85ab65088bc565549c262289cb64f9aeca0508290825
-
Filesize
29KB
MD544e459665555aa71b27739a4c8e0ce2e
SHA1a356a45529a77684280cab95f9658263facadedc
SHA256791918b0fdd6d93878a051a648a2d60d04f2e12fb5428d138dcc2b63fbf94c13
SHA512ede586c602defafd40a4507989f664d3345a5b0b2172251e10f84d87e44ee56b9546e04c7f7aeb621d72be7714de56f01ca06c0cf266938165d3408cc92969b7
-
Filesize
9B
MD579a2fb76ad00a8ac07f11b6a179f5297
SHA172b4f589fd7945d8c80b370d1d3a1f2467f3eb81
SHA2562f723e98c3a3556269a4d81d4a27d6a0ab13a84c5ba737493c07354a2608684f
SHA5123a21c2e60e8e035fb90d428e86bb927077d8354a16f1abc291ccba4a4d7fee4f51cf781fa9202e5602a88ca70a6ba264ac49762100be5f6e09a2ec930e098168