Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
Resource
win10v2004-20230831-en
General
-
Target
b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
-
Size
61KB
-
MD5
2224d723081f8600cd557e3e7afa0327
-
SHA1
6371dba08a4de5c714d5e01815aa237d18ced619
-
SHA256
b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47
-
SHA512
6dbda848b02b4b95785d397743c369101afddd797776f6702b09737a6d3b68d3d5773ef48482a9f9beb6be2d4455645a0252a4b43f65c0f582bf6cdd2d92ee74
-
SSDEEP
1536:Ta13SHuJV9QaxSzc1kVQctbHB1gTXL7heiEE:TkkuJVFSqctbHB1ufQJE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5016 Logo1_.exe 2696 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe File created C:\Windows\Logo1_.exe b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe 5016 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1128 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 82 PID 1444 wrote to memory of 1128 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 82 PID 1444 wrote to memory of 1128 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 82 PID 1444 wrote to memory of 5016 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 83 PID 1444 wrote to memory of 5016 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 83 PID 1444 wrote to memory of 5016 1444 b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe 83 PID 5016 wrote to memory of 1540 5016 Logo1_.exe 85 PID 5016 wrote to memory of 1540 5016 Logo1_.exe 85 PID 5016 wrote to memory of 1540 5016 Logo1_.exe 85 PID 1540 wrote to memory of 5020 1540 net.exe 87 PID 1540 wrote to memory of 5020 1540 net.exe 87 PID 1540 wrote to memory of 5020 1540 net.exe 87 PID 1128 wrote to memory of 2696 1128 cmd.exe 88 PID 1128 wrote to memory of 2696 1128 cmd.exe 88 PID 1128 wrote to memory of 2696 1128 cmd.exe 88 PID 5016 wrote to memory of 3176 5016 Logo1_.exe 55 PID 5016 wrote to memory of 3176 5016 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA98E.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"4⤵
- Executes dropped EXE
PID:2696
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:5020
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5b2b6ae1421d2be0d90ea86141066f966
SHA1a3560801ceaf269bf35fa26f46eefb627247f04d
SHA2564cbace4b732b3150e3a61a8d7b7abc796ddad3902ecbadb315e7b7b271e18aa0
SHA512ae1e0fc0cc765f3ea17f72187af6e871445d4cc8e67fd7a023c8ed96633807608ae4437eabbf6e2c84cc2dbfec3785a26f3c17793f31e1701d21b9b82e2d6bc3
-
Filesize
487KB
MD5c061e7f482b3e1a8f6cadee8cd4ff18b
SHA1bd09fe0f105e964c0b54b887748d65ca61f5ca76
SHA2566f2cdb9367b16f1b40342c11b5184fd5b0a902dce2d525fd6fcf4110cdc23e51
SHA5122d1eb4be83a6931fc32326e7b628097e02a85e9c33850bbc0225a282465513b12f158e1ba32c8f54298817e9d4bb6ca54844d5ad8c398a26d0e8c93db37a0d9c
-
Filesize
722B
MD58b1a07152c1a273457b7ea61a5f1b285
SHA17c46072448a2d944ffcf784ec3873fde96d487c8
SHA256d48f3af92b817e8b83e051d220ab6337d2b46675d911ee847758e84481676a6a
SHA512dcbd767499ad47a45782074074787499ad8786e6a57e94d16e9d1ba914e4bd68a9182d466663d7e577cdbdc6be3673632187e22a565dd5832838f3bbc81b3d2f
-
C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
Filesize32KB
MD53de16cea01950aac6a7a5eeb8cb102b0
SHA1c89dd3ce02600d1ef68a83e85947d7e8c4e62cc8
SHA256cd60e89b2ff2743bad3c298ab6f44e005e4986413d1cf97bede0185ac3f12280
SHA5127120b8226aac32933bc1561b432093422a4d708b3c75bd4eea506f7f6586b0014ce2debf7da71874947274632db6f7ffd67b5ec0c88dd9d8f2ecff0b34e12df2
-
C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe.exe
Filesize32KB
MD53de16cea01950aac6a7a5eeb8cb102b0
SHA1c89dd3ce02600d1ef68a83e85947d7e8c4e62cc8
SHA256cd60e89b2ff2743bad3c298ab6f44e005e4986413d1cf97bede0185ac3f12280
SHA5127120b8226aac32933bc1561b432093422a4d708b3c75bd4eea506f7f6586b0014ce2debf7da71874947274632db6f7ffd67b5ec0c88dd9d8f2ecff0b34e12df2
-
Filesize
29KB
MD5a784c027199a4a152e6bda9335389b6d
SHA11471692fc01a6efbcdd85bddecb7f189dc2a0223
SHA256ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e
SHA5126eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999
-
Filesize
29KB
MD5a784c027199a4a152e6bda9335389b6d
SHA11471692fc01a6efbcdd85bddecb7f189dc2a0223
SHA256ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e
SHA5126eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999
-
Filesize
29KB
MD5a784c027199a4a152e6bda9335389b6d
SHA11471692fc01a6efbcdd85bddecb7f189dc2a0223
SHA256ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e
SHA5126eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999
-
Filesize
8B
MD5587438ba3214d6958f23eced1b2cd39c
SHA156d9150b977089419b026aaf6ee032981c437dfd
SHA2564a9d4c3f321c10e2bb0319dca7695b9b3252a0e1d35cfc2a09bac15d5c36e090
SHA51231309fcfa73bf18bb138cbe3744414acc13498184290586c8f185e828027f7b0c647f3f102826099465c7995a29e8a33d95f832ffac8d16b619b53f037e4fd63