a51619f82f4b0a2805cdf55d28176d45c73540dc39c913a75b0267b965aba664

Analysis

user interaction
yes
max time kernel
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LogoFAIL.exe
Size 216KB
Sample260809-s5fpnabb53
SHA256 a51619f82f4b0a2805cdf55d28176d45c73540dc39c913a75b0267b965aba664
MD5 dbc8228004c591d1fa1cc2b4bf5d6b3d
SHA1 4ff0e69ec635b5ac6b91ab2a8b0bbf605620efbb
SHA512 1d76317abe1220a8fc010226d9db0fe6a4cdbbdc3690937fd062fe1cf68c411de6465d97ab6ecc72020e226e212724b9183a05381aad6e13a5438191629b8df9
SSDEEP 3072:KMobR7ezAjLOZvmX1X5GWp1icKAArDZz4N9GhbkrNEkee3i5asChS4jErjvcv7It:XeR7eammXp0yN90QEVqzjy9
TLSH
T10424AF1A73E421A6E4B6437099F603839A32BCB16B7492FF27C5D57D0E336C0A536B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LogoFAILlogo.png	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LogoFAILlogo.png	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LogoFAILtext.txt	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	LogoFAIL.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1908	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4820	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1908	2336	LogoFAIL.exe	80
PID 1908 wrote to memory of 4820	1908	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\LogoFAIL.exe
"C:\Users\Admin\AppData\Local\Temp\LogoFAIL.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c LogoFAIL.bat
  2⤵
  - Creates a file in the Startup directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\timeout.exe
    TIMEOUT 3
    3⤵
    - Delays execution with timeout.exe
    PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LogoFAIL.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LogoFAIL.bat
Size 2KB
SHA256 193f8e58aef2f1782d684551b51972b312bfb21bf228e49f3d3b53ac16969b2b
MD5 149f953689e613a2f292d25e1cccc06a
SHA1 78e7bb1f00c8fc024e5fc00af20c7a43621e77e9
SHA512 362d1c56241f6c7ac99b731c5f9a9c44a2f7af38c044d69e3034c78c494370e760a2b7cf6534b3d9b6dfe3952b4c212257c802fde2f14a9166b389b9fe33a567
TLSH
T15D418D19FD98B0CEA7B2E24116776508FD046C93EF026E1A315F48BB0B8468877AE456
MD5 SHA1 SHA512 TLSH

Submit Download

LogoFAILlogo.png

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LogoFAILlogo.png
Size 47KB
SHA256 3d34ddf5b6e5a02752030e13e538be9c9302baa9de80ea71687dd3c8ac1db8cf
MD5 2db228d47d9ed7b4fedc2f23e1a53d30
SHA1 7728bf676f31cd675ff457c47bfa20e5172acae1
SHA512 07947c8d1c41a4ed7a66694bd986d7174d25eb805acc4f2c8376fedb246b62d764e8b5d7603f6a97c88990e7e3b419c389484cf26755f5bde07809fe96ea7ce5
SSDEEP 768:nJ+y1nY1bKpA0k1cz0vkbHzV6NB42F8ozFlJybtCUNu+T6OuajyK6l7i5oyYE:JLY9GA0kywvkbgmI3zFlJutCsxT6/aOS
TLSH
T1BD238DC2DF23F01CE58D5B354811DBB86A350BC46D9193A4FAB6A76806641CF49D3F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads