Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
Resource
win10v2004-20230915-en
General
-
Target
9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
-
Size
270KB
-
MD5
53c4eef25803a956d163431aea2326fb
-
SHA1
06a1b33c1660f65e960bddf4b9a7542594c65207
-
SHA256
9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e
-
SHA512
567d688d46e44c48a1f8912d2609c2b9689a3792e0171c079beeccf71e4189e99ec7c1a6b6bcfdfbe6f02939958ee366a7e8b9729390082ddc50f4f7d9827a1c
-
SSDEEP
6144:ZVfjmN5yMqd+wKVVrcAaTaJaeQ5uFhODs3pXsGKLu8N:v7+YHKV5cA3J04OD0tmx
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1120 Logo1_.exe 2248 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe File created C:\Windows\Logo1_.exe 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe 1120 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2820 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 85 PID 2316 wrote to memory of 2820 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 85 PID 2316 wrote to memory of 2820 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 85 PID 2316 wrote to memory of 1120 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 86 PID 2316 wrote to memory of 1120 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 86 PID 2316 wrote to memory of 1120 2316 9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe 86 PID 1120 wrote to memory of 4152 1120 Logo1_.exe 88 PID 1120 wrote to memory of 4152 1120 Logo1_.exe 88 PID 1120 wrote to memory of 4152 1120 Logo1_.exe 88 PID 4152 wrote to memory of 1392 4152 net.exe 90 PID 4152 wrote to memory of 1392 4152 net.exe 90 PID 4152 wrote to memory of 1392 4152 net.exe 90 PID 2820 wrote to memory of 2248 2820 cmd.exe 91 PID 2820 wrote to memory of 2248 2820 cmd.exe 91 PID 2820 wrote to memory of 2248 2820 cmd.exe 91 PID 1120 wrote to memory of 3192 1120 Logo1_.exe 54 PID 1120 wrote to memory of 3192 1120 Logo1_.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6949.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"4⤵
- Executes dropped EXE
PID:2248
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1392
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD54df9f5846fa9747b1b7d5f543b65f872
SHA119609926804d5e8fb8d7b2018a79b929d8b1a5c2
SHA256c3508a574a46ca5e7faa5be9cd40e200ef7d168ffe0437423f75e775f1bfc267
SHA5123830e5ab004f302e0e03e647834e7562d4a100a3dd5ebd8ae5b65551d58dd7ad17960c90e67b494d750985ed37719f8fd718f00335673890f295703ea436f992
-
Filesize
484KB
MD5588fc700b9d21a282aa63e1b999b7e20
SHA176dcdac47073b2f966f2f1d0ef89674b81323869
SHA25683710853ff1b81c482bca2496a8c57be7a987f9f0db4b4d4660098d7f19921ce
SHA512073d2f78eaa7399041e2d3b88f367e400a1c9df688dc0b0f644178a53d93685d68bfd46138a467831ca654905ee6fd44d883a88d0091dcc1249c7910881f7aef
-
Filesize
722B
MD51eeed9e36862c1cb4b6fc49ef5fa2d62
SHA189ac1dd3f83bb4152ecf92a17cad53696116c8cc
SHA256d6f26ae82a4e4da6266fe44d08f3736ba73f67399d835f858db65891313c68cb
SHA512e6615d2f386a9b55a1de8234d2c1908f68aea46fd2a48cb92b431cf5d9c6ad94a0aeb4c0a9e82e461f98f0385d0e62981b6f8eb09e810dc1059a7490b9cf96e4
-
C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
Filesize244KB
MD5efcc672f35bd784a307e079c8da923bd
SHA117de07708d7eab2b470ce9bc5e08cc125e195600
SHA2563a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b
SHA512e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca
-
C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe.exe
Filesize244KB
MD5efcc672f35bd784a307e079c8da923bd
SHA117de07708d7eab2b470ce9bc5e08cc125e195600
SHA2563a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b
SHA512e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca
-
Filesize
26KB
MD5c272effd2155088a7c7aee29b42312c5
SHA134592ffcdd3f33e73878b5bade9e55a309efcbd7
SHA25697ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c
SHA5120c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28
-
Filesize
26KB
MD5c272effd2155088a7c7aee29b42312c5
SHA134592ffcdd3f33e73878b5bade9e55a309efcbd7
SHA25697ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c
SHA5120c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28
-
Filesize
26KB
MD5c272effd2155088a7c7aee29b42312c5
SHA134592ffcdd3f33e73878b5bade9e55a309efcbd7
SHA25697ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c
SHA5120c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28
-
Filesize
9B
MD50387f4acd0cfa16ac07fab88bff7f344
SHA160da1a37a16077ad337f6a91cc4acb9fba2940b3
SHA2560b1b21f717a6f4add9692073f01b9b560898213b197ef3b47165d56be17c617d
SHA5127d52216da22ceed1afe2b9d31fcea1798b2879eb6426d3634f38b7ea296627c516ff022d3cfe34df3aac4fa6fb6e2ad8eb21d2c9c040c83c53ea79487b1d13ab