Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Resource
win10v2004-20221111-en
General
-
Target
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
-
Size
56KB
-
MD5
1061d59747c43b312f76dafa35c83e30
-
SHA1
087156122d65dc49bf8eff5468c363a998a87b89
-
SHA256
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59
-
SHA512
1df8001454ad3c830261a7a51ef69e73485931ca8824d7b8eaab66ccaa1c87d85615ae4d2793555ab6529ebd8e7be377b6a42f96f2a2e235b10c70a82a4aa580
-
SSDEEP
768:pO16GVRu1yK9fMnJG2V9dHS8FY1st5LxI1Q4AwdVGWq0CVacOI+EfAympPvbr:pI3SHuJV9Na1O+GWq0CccR+eenbr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4336 Logo1_.exe 3572 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\db\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe File created C:\Windows\Logo1_.exe 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe 4336 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3432 wrote to memory of 3936 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 83 PID 3432 wrote to memory of 3936 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 83 PID 3432 wrote to memory of 3936 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 83 PID 3432 wrote to memory of 4336 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 85 PID 3432 wrote to memory of 4336 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 85 PID 3432 wrote to memory of 4336 3432 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 85 PID 4336 wrote to memory of 3576 4336 Logo1_.exe 86 PID 4336 wrote to memory of 3576 4336 Logo1_.exe 86 PID 4336 wrote to memory of 3576 4336 Logo1_.exe 86 PID 3576 wrote to memory of 3948 3576 net.exe 88 PID 3576 wrote to memory of 3948 3576 net.exe 88 PID 3576 wrote to memory of 3948 3576 net.exe 88 PID 3936 wrote to memory of 3572 3936 cmd.exe 89 PID 3936 wrote to memory of 3572 3936 cmd.exe 89 PID 3936 wrote to memory of 3572 3936 cmd.exe 89 PID 4336 wrote to memory of 1192 4336 Logo1_.exe 34 PID 4336 wrote to memory of 1192 4336 Logo1_.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B22.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"4⤵
- Executes dropped EXE
PID:3572
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3948
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD574c06769d20d78c9e28a27f4bd197e20
SHA198d1f937ad99b94d8e84fff9e125a750d6ae2065
SHA2561b68d6a98e10d5ce2aec5cd4405fbe8616a6e35efb985bc80fc1bbcc0e1d2462
SHA512ca7e36c33f61a975970646fb5eca6d474ddfc6a32e1fd30faffbf6f7b5fcb5bc8063ea82c854106ccf42e75be996637640ef553ce39d9efaaa98070925551532
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756