a1a4f3271530313b104841da3ba148bd8b62a42995e98e7f4b2217eeab997945

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
Size

750KB
MD5

a0a0d5e2b2a8146b7cf6eda1a7fcb8f0
SHA1

4c89d6fa3bf706d6b49a8ff33e6c3c7fb265e685
SHA256

a1a4f3271530313b104841da3ba148bd8b62a42995e98e7f4b2217eeab997945
SHA512

2a1af45888b92ce460b5c77f22fc647ebc3fac443ce4a4f52d397a9f545f07456269c763e96dba1e6dd2b609349291a51ca3881cdebc4d776e331385360be02a
SSDEEP

12288:Z/JtfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:Z/zLOS2opPIXV

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2680	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2644	Logo1_.exe
2900	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
1424	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2680	cmd.exe
2680	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Logo1_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe
2644	Logo1_.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2680	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	30
PID 1188 wrote to memory of 2680	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	30
PID 1188 wrote to memory of 2680	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	30
PID 1188 wrote to memory of 2680	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	30
PID 1188 wrote to memory of 2644	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	31
PID 1188 wrote to memory of 2644	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	31
PID 1188 wrote to memory of 2644	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	31
PID 1188 wrote to memory of 2644	1188	a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe	31
PID 2644 wrote to memory of 2620	2644	Logo1_.exe	33
PID 2644 wrote to memory of 2620	2644	Logo1_.exe	33
PID 2644 wrote to memory of 2620	2644	Logo1_.exe	33
PID 2644 wrote to memory of 2620	2644	Logo1_.exe	33
PID 2620 wrote to memory of 2520	2620	net.exe	35
PID 2620 wrote to memory of 2520	2620	net.exe	35
PID 2620 wrote to memory of 2520	2620	net.exe	35
PID 2620 wrote to memory of 2520	2620	net.exe	35
PID 2680 wrote to memory of 2900	2680	cmd.exe	36
PID 2680 wrote to memory of 2900	2680	cmd.exe	36
PID 2680 wrote to memory of 2900	2680	cmd.exe	36
PID 2680 wrote to memory of 2900	2680	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
"C:\Users\Admin\AppData\Local\Temp\a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$a3E0A.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe"
    3⤵
    - Executes dropped EXE
    PID:2900
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a3E0A.bat

Filesize
536B

MD5
99eba073ba2d3c6a6394bb165253e3a3

SHA1
f64b2047c63839df74f9208cf3b588580a598e08

SHA256
df8986bf05db0cdf875641ba324181d8ddcf83eab91ae8d3f9ec8e04e92285b8

SHA512
fd9dad03fd4d510eedf2a48155ed604363a9e3c1b0dffa33c43248d38b372d2d73071d180c958539861828f6c905ba52631481240485651079725dd8a849881c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a0a0d5e2b2a8146b7cf6eda1a7fcb8f0N.exe.exe

Filesize
684KB

MD5
50f289df0c19484e970849aac4e6f977

SHA1
3dc77c8830836ab844975eb002149b66da2e10be

SHA256
b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

SHA512
877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

Download Submit
C:\Windows\Logo1_.exe

Filesize
66KB

MD5
d7738236372c06d814815ccf1ad6b466

SHA1
b69606e5e7d7b8ab7332c47c429519a64b2865ef

SHA256
5aca5f4c47778b2b18728a20aa6802f4eaf5b62395e340da4d889bbfca012070

SHA512
eb40a60cc4a28b59880f2442bfee142e8b49cf7c4f5cd6a2bd7e1ae417baf1647a48b866a88bde07eab5fed4597aa4e47b6a42adfeed6ef7d37c8c3d1385f789

Download Submit
memory/1188-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-26-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-34-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-127-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2644-165-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download