Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
177s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Resource
win10v2004-20230915-en
General
-
Target
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
-
Size
122KB
-
MD5
d28d3d4d2d8c5cd938d85beada8ad680
-
SHA1
7279e7100d1e7ab52d1373062571fdc4c53feeb0
-
SHA256
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2
-
SHA512
34fe40b7dced69e6d02a7510749f209aaa269705fbf330c71c878dd83b8278bb24880ebfda4ac7a9c44d264dbbd18240c1fc78ed99829fa7d62541c4214e1099
-
SSDEEP
3072:OftffjmNSoFHzg2I0PpPNX6RLXWertCQyyNU:2VfjmNvZzhPpPNq6QyH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4944 Logo1_.exe 3280 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\az\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ta-IN\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre1.8.0_66\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe File created C:\Windows\Logo1_.exe 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe 4944 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3036 wrote to memory of 4584 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 87 PID 3036 wrote to memory of 4584 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 87 PID 3036 wrote to memory of 4584 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 87 PID 3036 wrote to memory of 4944 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 88 PID 3036 wrote to memory of 4944 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 88 PID 3036 wrote to memory of 4944 3036 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 88 PID 4944 wrote to memory of 1552 4944 Logo1_.exe 89 PID 4944 wrote to memory of 1552 4944 Logo1_.exe 89 PID 4944 wrote to memory of 1552 4944 Logo1_.exe 89 PID 1552 wrote to memory of 4020 1552 net.exe 92 PID 1552 wrote to memory of 4020 1552 net.exe 92 PID 1552 wrote to memory of 4020 1552 net.exe 92 PID 4584 wrote to memory of 3280 4584 cmd.exe 94 PID 4584 wrote to memory of 3280 4584 cmd.exe 94 PID 4944 wrote to memory of 3132 4944 Logo1_.exe 53 PID 4944 wrote to memory of 3132 4944 Logo1_.exe 53
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A3.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"4⤵
- Executes dropped EXE
PID:3280
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4020
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD54e68211d5ca5b4384780da7163aca122
SHA1067ede6d5d2e700aede8416cbc1344b48bc7f403
SHA2563fc8a84a337c74c13ea397c9fd998726b36ccab37404f05a3460c0ee4be2d38d
SHA5129e0d960b1bba53fef5641d5b26ac1798547882cf3d556d58a14bdaf30c00dd5e88b569a7ea362f9f60c92b001aa3267e1968854f45f0897f4b27fdacf16f14de
-
Filesize
722B
MD52192838a0bdfb0364f54f7d45baf4cfd
SHA1824709ed9984fcacfc3c52b6b4b6def689f68d75
SHA2568ba74dca1243f18b992dd79b8127170b7a5e51e0e50f3315a1d8a2b15ad544a9
SHA512977fdaa1b6507a35dc762119e7611fcdcec47c4b05d1160727a3104f4aa9ad2e7cc3b1e5542e1290d9adca1de3de05fa54a98bbbf91738102ef5578f22c3c0ef
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Filesize96KB
MD54f777a9f156035ab4670da6cdcbd651c
SHA178b6f97056e6d5674bbcb94f13c4bf5527319c02
SHA25677a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8
SHA512244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe.exe
Filesize96KB
MD54f777a9f156035ab4670da6cdcbd651c
SHA178b6f97056e6d5674bbcb94f13c4bf5527319c02
SHA25677a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8
SHA512244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
10B
MD581570c50286369016cef7a9f904c4b04
SHA1b5758b23667cb35cad0adb23371b830fcee4f4e5
SHA256b882f41a5c84d248a75714eaf215a9e363a49361b6a14beedb921ee3dfdb46a1
SHA5120e6c479b0252e24635810b7d030cc9b5b17603ee20ccf62812446b8d15884521c6c7be65dfc0090bb1502e859fae27c2a63b3e58be714021f473a88407982162