Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe
Resource
win10v2004-20230915-en
General
-
Target
5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe
-
Size
130KB
-
MD5
3f9c4773f4a114fa486802f67952af9c
-
SHA1
7624e7e72196d39718467a651ca6d87ed664f27d
-
SHA256
5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c
-
SHA512
d5132ee9d28f962ee083acd9adcdabb5488a1e0ac53e0d49053751a939af55d5f0bd9a062fc43d6df3b4ca50c9bd83c40fcf49c88c666e04856510bd25ad8d3b
-
SSDEEP
3072:dftffjmNp6lSdjdGxfXPBgN0wS4SmHknODW+yw561vhvon8Cu1:tVfjmN+xfXeN0YSlODP5qsa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4556 Logo1_.exe 4812 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\applet\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe 4556 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3380 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 83 PID 3480 wrote to memory of 3380 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 83 PID 3480 wrote to memory of 3380 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 83 PID 3480 wrote to memory of 4556 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 84 PID 3480 wrote to memory of 4556 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 84 PID 3480 wrote to memory of 4556 3480 5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe 84 PID 4556 wrote to memory of 1552 4556 Logo1_.exe 86 PID 4556 wrote to memory of 1552 4556 Logo1_.exe 86 PID 4556 wrote to memory of 1552 4556 Logo1_.exe 86 PID 1552 wrote to memory of 4568 1552 net.exe 88 PID 1552 wrote to memory of 4568 1552 net.exe 88 PID 1552 wrote to memory of 4568 1552 net.exe 88 PID 3380 wrote to memory of 4812 3380 cmd.exe 90 PID 3380 wrote to memory of 4812 3380 cmd.exe 90 PID 3380 wrote to memory of 4812 3380 cmd.exe 90 PID 4556 wrote to memory of 912 4556 Logo1_.exe 65 PID 4556 wrote to memory of 912 4556 Logo1_.exe 65
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe"C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DEA.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe"C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe"4⤵
- Executes dropped EXE
PID:4812
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4568
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD5a765796cc9687d00d1a8bf9a1f07f64b
SHA1687387dfbd4cbee2807ed407807545c9e001579e
SHA2560766548a137e452788407d9ab5e59ae2498fee5648b1e74c4380a31cd1884ad3
SHA51233c6500d6202f05782b18843600872f1fe401a181022c2ac288fe46c5d904ccaea8dc4b003f9763210e0d7b2e3d350eafbf64b4996bb7cda994c978bab7add15
-
Filesize
722B
MD5babb208244b2197859f7f6418e7ef3c8
SHA10f391377bc0bbc8f4a788bc439d966cafa6d140c
SHA25654425c4ab823f31beeabc8d74fbaf96f1a0fd7513ec0930c9dcade74d98f800a
SHA512fd3eb86f116cb6c8571fd2892ec38c6fbe5b7015cc837c3f8d9dba1df52c31b611a453fb87ba700562dbc8c36f329ec38a452545219033dfeb79a059ce09039d
-
C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe
Filesize104KB
MD58c40debdd310ecabae5e13c747d4dbe1
SHA11305ff6198deedd84101a26e24f9ba6e8741faa0
SHA256edd575cb557452eb1643bc486ad253c14a4f4412045537bdbcd06e41c380b84c
SHA512108123958b878596a3617121c0aa62f2ca96e805aa880d84be6af54dab8a2cae07c29501dfb8fa2ca460da5a83128ed48147fff391f64951a66f32c80f982c20
-
C:\Users\Admin\AppData\Local\Temp\5d10c66c29637b3d2f8c2b7cd501a9d0df1f34ed0d018fe6496c82907573939c.exe.exe
Filesize104KB
MD58c40debdd310ecabae5e13c747d4dbe1
SHA11305ff6198deedd84101a26e24f9ba6e8741faa0
SHA256edd575cb557452eb1643bc486ad253c14a4f4412045537bdbcd06e41c380b84c
SHA512108123958b878596a3617121c0aa62f2ca96e805aa880d84be6af54dab8a2cae07c29501dfb8fa2ca460da5a83128ed48147fff391f64951a66f32c80f982c20
-
Filesize
26KB
MD5ef6b152d20d85fa5f08f11fd01ae7d99
SHA1f83ca8480a772e18bb8f53e0c12891ffbdb5fcd4
SHA2562c7a5ab62040587b3d59d81bb480811c32b146920acbe558374898ef005ce2c7
SHA512eb95d953a4fa8eb68cb607bf2730a858062e523a6c4eb0862ad7fcd44db119f5c3f23fdc0b270359baa0dced3226977854843bc58545af2ec26c11bb88e3b1e5
-
Filesize
26KB
MD5ef6b152d20d85fa5f08f11fd01ae7d99
SHA1f83ca8480a772e18bb8f53e0c12891ffbdb5fcd4
SHA2562c7a5ab62040587b3d59d81bb480811c32b146920acbe558374898ef005ce2c7
SHA512eb95d953a4fa8eb68cb607bf2730a858062e523a6c4eb0862ad7fcd44db119f5c3f23fdc0b270359baa0dced3226977854843bc58545af2ec26c11bb88e3b1e5
-
Filesize
26KB
MD5ef6b152d20d85fa5f08f11fd01ae7d99
SHA1f83ca8480a772e18bb8f53e0c12891ffbdb5fcd4
SHA2562c7a5ab62040587b3d59d81bb480811c32b146920acbe558374898ef005ce2c7
SHA512eb95d953a4fa8eb68cb607bf2730a858062e523a6c4eb0862ad7fcd44db119f5c3f23fdc0b270359baa0dced3226977854843bc58545af2ec26c11bb88e3b1e5
-
Filesize
9B
MD5872506f1dadcc0cedd1e9dee11f54da4
SHA1d1e87145ed1d918f10ae4e93ccdbb994bc906ed5
SHA256a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104
SHA5126cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c