Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
-
Size
43KB
-
MD5
af29bb51932c629db68517588718951e
-
SHA1
609810cd2fa4f35c58cad7fb0754f092fd29fd39
-
SHA256
b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300
-
SHA512
6b31fbad7506f34aff42415e2de41392eb876274bbff37f82ecd89d33ca9f5e1f3d9a1cbdf46f57fd3843d5e87445c85e5df06ab28f9bf9c8dd317637ab9cd70
-
SSDEEP
768:ptq16GVRu1yK9fMnJG2V9dHS8clXNGSs8zCaLWE4bCfJ:ptM3SHuJV9NwllCaadCfJ
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3204 Logo1_.exe 1624 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe File created C:\Windows\Logo1_.exe b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe 3204 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4908 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 81 PID 2148 wrote to memory of 4908 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 81 PID 2148 wrote to memory of 4908 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 81 PID 2148 wrote to memory of 3204 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 82 PID 2148 wrote to memory of 3204 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 82 PID 2148 wrote to memory of 3204 2148 b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe 82 PID 3204 wrote to memory of 3604 3204 Logo1_.exe 84 PID 3204 wrote to memory of 3604 3204 Logo1_.exe 84 PID 3204 wrote to memory of 3604 3204 Logo1_.exe 84 PID 3604 wrote to memory of 4444 3604 net.exe 86 PID 3604 wrote to memory of 4444 3604 net.exe 86 PID 3604 wrote to memory of 4444 3604 net.exe 86 PID 4908 wrote to memory of 1624 4908 cmd.exe 87 PID 4908 wrote to memory of 1624 4908 cmd.exe 87 PID 4908 wrote to memory of 1624 4908 cmd.exe 87 PID 3204 wrote to memory of 3036 3204 Logo1_.exe 54 PID 3204 wrote to memory of 3036 3204 Logo1_.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA378.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"4⤵
- Executes dropped EXE
PID:1624
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4444
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD555ad31ca27ad9c5362d23096cc5e251f
SHA19096a486c7974a16f39f91cfbff816ec8ffb6ced
SHA25649535424c80d07ff3a5a412e45f614c3d22da9b68c513e094e8f2a6e3f131d32
SHA5123deba7e0e453a361ef0771bc3c8fe24dfe3b9d3c08c5aff4e97d7146ffc06df96827566824773b57b1af1ddee5bbbc7b4d7ec1552c3176cd4ac6150b7ad90cda
-
C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
Filesize14KB
MD513871c4426dda78f91e88e43d51844a8
SHA13e5dc5d662ac718ac29da73ef5ba00662a3601ce
SHA2569c6a5caa334daecabb9b9080f10973aa3d3971ea12d16e218a71a23248634621
SHA512020e67422bfc212aa0d7d45eeedb76bc86a8ad254ef1463fdc783596c400680e144bbd6859ae6a58db2cc4ddfaab25711cf8e3a20680e6d121c14d3fa9a32802
-
C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe.exe
Filesize14KB
MD513871c4426dda78f91e88e43d51844a8
SHA13e5dc5d662ac718ac29da73ef5ba00662a3601ce
SHA2569c6a5caa334daecabb9b9080f10973aa3d3971ea12d16e218a71a23248634621
SHA512020e67422bfc212aa0d7d45eeedb76bc86a8ad254ef1463fdc783596c400680e144bbd6859ae6a58db2cc4ddfaab25711cf8e3a20680e6d121c14d3fa9a32802
-
Filesize
29KB
MD5bed9993f2e1de936175e3e499262bda3
SHA104d9ec2bcc4cc85dcd808b6488363885be37576c
SHA2565ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2
SHA512a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763
-
Filesize
29KB
MD5bed9993f2e1de936175e3e499262bda3
SHA104d9ec2bcc4cc85dcd808b6488363885be37576c
SHA2565ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2
SHA512a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763
-
Filesize
29KB
MD5bed9993f2e1de936175e3e499262bda3
SHA104d9ec2bcc4cc85dcd808b6488363885be37576c
SHA2565ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2
SHA512a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763