Analysis
- max time kernel
150s - max time network
51s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe
- Size 221KB
- Sample260825-lcjsaagm4x
- SHA256 cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31
- MD5 ffcf65690c128bb502ebe618fe478c32
- SHA1 8786a74c50d2780695468612468cd69bb4cf4e1d
- SHA512 59bb73d65922215e9df2777d11207f6f298c4e013208d03433e3a76d68db0b9beb7fdd93772d6da20c597033a2881dca5004ae7368b355eb8ae1be8268f4c240
- SSDEEP 3072:BftffjmNNyDh+GOhw7suSGpm8TDesXUV3QSJ3BDUVjHtOHCI7e:JVfjmNU1LeEluV3hKtO
- TLSH T1C42419A836686B61D03E83FD8561510013F6B27E299EE3CD5EC664EF1E72B01C5C668F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4192 Logo1_.exe 2540 cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe File created C:\Windows\Logo1_.exe cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3464 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe 4192 Logo1_.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5052 wrote to memory of 3464 5052 cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe 89 PID 5052 wrote to memory of 4192 5052 cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe 90 PID 4192 wrote to memory of 5808 4192 Logo1_.exe 91 PID 5808 wrote to memory of 1372 5808 net.exe 93 PID 3464 wrote to memory of 2540 3464 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe"C:\Users\Admin\AppData\Local\Temp\cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe"C:\Users\Admin\AppData\Local\Temp\cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1372
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
- Size 124KB
- SHA256 8c76d893c1e0d4203b6b90eaa28a7453c6a4d814a38486844e70c74da40a6b2a
- MD5 1d35959a1600b89f6cbd6b0a84b333e7
- SHA1 bf4092057263daf8fa1d465a648ce366b3725c1f
- SHA512 45ea124ba77cd313394fac24b237712509e01c35f1494328800d59e12fb7eff194b3b59b6ad7883586bf3872e1283569b9c96035fd7a4b19e4e1b7fbf5b06c00
- SSDEEP 3072:mftffjmNIhUBf8Bo/mu+YDfYz8KrRVwWEhPd4zB+IPFP6n:eVfjmN2G7/fYfLvzB+QFyn
- TLSH T1B8C38D1375D08871E5B20C3449E1EA619E3FF9620B409EA737C466BE0F317D1DE26E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 481KB
- SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
- MD5 1db5b390daa2d070657fbdb4f5d2cc55
- SHA1 77e633e49df484b827080753514cc376749b0ceb
- SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
- SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
- TLSH T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
- Size 722B
- SHA256 c6f45280e42dc9ce51636c3002ccdddbefa9c865e37a36c8da3317b91ecd1f09
- MD5 0604e595be0e05c671df1b36ccedb936
- SHA1 1b1d5f8fef814738df4d178bb424340755fbcd0a
- SHA512 c3d0ef61b0151736b1fd07cd63fd430e4d464402c887fc55066e91a5e36b05bbb65d3a3d1edad0203b688523c02ba95c1a8f98fad155db09c8a05d00e505c64e
- TLSH T136019EA0A18FEF4EAE477057666088EC83E21E1AFB4C2A4F0F10D098219162973F7712
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cf3cdec34db8e1d30f9f1309cb1994b338faf85ca110eee45b6a4c98ccdd2d31.exe.exe
- Size 195KB
- SHA256 a02e39634696386087b1d7933989724e8244db16acbc15ab10399b9b1e6cca11
- MD5 afd20ff0b803c0c58db97b26a10468a8
- SHA1 7dbdd28b1d86a4a7aee15d0fa0dc519bb05fd312
- SHA512 ffcc57b78e48078a2bab51b6f8701289ebe9a3547de9a6b03ed7cdeab7ddbd3abb004f6502f562399d692642e6c501dfb8896a2a44daf188206235c90158858a
- SSDEEP 3072:xyDh+GOhw7suSGpm8TDesXUV3QSJ3BDUVjHtOHCI7e:Q1LeEluV3hKtO
- TLSH T17214F7A836686B51D03E83FD4561510013F6B27E2A9EE3CD5ECA64EF1E72B01C5D268F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 26KB
- SHA256 2a47eb8867a424469f1572d7c66d7c29451b748b13f60e558a1ec64298c9d7db
- MD5 f67a4591e42c902f5c4b305005604934
- SHA1 a8cb362c4b20b1c8d00841acd7ec2529455fac02
- SHA512 e5df637bb2255bfca828c4345dac34d520b0329c31766b642e20124681da4f7bb601a2385fd3ce4a19954b477162bf7b451388fdc4e64ed02f516ecbbcc6b4b2
- SSDEEP 768:8A1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:8SfgLdQAQfcfymN
- TLSH T1A5C2E07627C82934EC26597CCBD35701833D0F7A149FAD6A36F1697E2561B68100FE27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-3986082593-3624157295-3514260330-1000\_desktop.ini
- Size 9B
- SHA256 1962ce70116500adabf0740e812e54bf58d48913f891249fc2b7c8e97bf58d22
- MD5 774f23175963b3baec428d4996ba7050
- SHA1 18dadf24eadb7a41ad3f29b5a48f8ef1262582a8
- SHA512 9d47d8cda825163a0a3953310abedc8d9502a0d204558bf869b63d442dead36509281d31b55310d27124871a8ae937e31d93090ec61f0ff729104418e35e82a6
- MD5 SHA1 SHA512