Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe
Resource
win10v2004-20230915-en
General
-
Target
2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe
-
Size
99KB
-
MD5
ceea6638b83ca939a0df100d39de574b
-
SHA1
0c2d176a1b2b8e051d9998173835c523a7a2efa0
-
SHA256
2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524
-
SHA512
b3c8e659ed51a04d8035ee38e548faea672db93d2e8ec8bf3206610783e2389a7680408d3a30bfe0b16bc8cc89776e3792956992691bc8531038938ec01647d5
-
SSDEEP
1536:xfgLdQAQfwt7FZJ92BsQCKBAR2pmU/BGhkp3szGPpbTDblnYVJV1PBs:xftffepVPn4ARXU/HZ9/D8Ds
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\FileAssociation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\css\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre1.8.0_66\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe File created C:\Windows\Logo1_.exe 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe 2836 Logo1_.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4392 cmd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1132 wrote to memory of 4392 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 88 PID 1132 wrote to memory of 4392 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 88 PID 1132 wrote to memory of 4392 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 88 PID 1132 wrote to memory of 2836 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 89 PID 1132 wrote to memory of 2836 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 89 PID 1132 wrote to memory of 2836 1132 2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe 89 PID 2836 wrote to memory of 4752 2836 Logo1_.exe 91 PID 2836 wrote to memory of 4752 2836 Logo1_.exe 91 PID 2836 wrote to memory of 4752 2836 Logo1_.exe 91 PID 4752 wrote to memory of 1952 4752 net.exe 93 PID 4752 wrote to memory of 1952 4752 net.exe 93 PID 4752 wrote to memory of 1952 4752 net.exe 93 PID 2836 wrote to memory of 3144 2836 Logo1_.exe 45 PID 2836 wrote to memory of 3144 2836 Logo1_.exe 45
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe"C:\Users\Admin\AppData\Local\Temp\2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4949.bat3⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1952
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD507c5e9a9f606b5ae33bdb24d21af81bf
SHA158be120b62a58788956df840d4462515829cf0e4
SHA25660ebb105f4147a89b4abc067a1e66dd97757738f945db1a90bf9799d56a45b94
SHA512c18d2519cfc5bcaee1483e4a77b6bbe9241310580bdeefee14870aef3973f113ab487ec58ee7d081661eb21e6c3a98f2044aa4b24cf0ee56a3f22e7321ece6ad
-
Filesize
722B
MD5ae756d9c40431413386fef08b623faa9
SHA1e4dcd2c74e530a555310a3355a650a0afac314e3
SHA256a68731e76a700b7ad30fa3100e696e83dc64013063bc2afbe6285cc26f74db32
SHA512b7b69e35d3af26a8fc672d0e4d843dd056c999938a87a31b376ca60fd2a9cdbbf41771568462f3a4d30d5876d796525ca4f042331a74c2d68992d2b8875a6d83
-
C:\Users\Admin\AppData\Local\Temp\2dbb8d0990103bf4776bc627e8b41de2630053cc67533ed38d5d05b3da195524.exe.exe
Filesize73KB
MD5a2f63aa3630f40b95ea45dca951a6785
SHA180f8cf7e7134682e661b1bbc08979d14bce13793
SHA256ecb8c2817df29a2c6d5057dae4a4ffb4a7bf4ae3e33aeca4be9f635c06f0380f
SHA5125e35ad38e9852b489a77a6d5ad028c5645b6c6987a6fee2a660186c34afa6ffd6db1dd255fec3ea5a92dc462c02832c9ed10bfa1772f9fed9aa774774c6662d8
-
Filesize
26KB
MD58758044db9fce67ea2ad542f86e69e57
SHA160cc4d25ea4e17f676e8ac8be10b9dfe2f7ed67d
SHA2560c91b552dc6db19b6711e32cb8c9c604b60dc9d674be06cccb6adf08b4dbd82d
SHA512411737be53feaef0829190b6610c729b925949bcc0b4a65063ab393acb1a92c577093e6377a373704ce54d27a593f2faddc23c80c660638f7c304a93f1972c93
-
Filesize
26KB
MD58758044db9fce67ea2ad542f86e69e57
SHA160cc4d25ea4e17f676e8ac8be10b9dfe2f7ed67d
SHA2560c91b552dc6db19b6711e32cb8c9c604b60dc9d674be06cccb6adf08b4dbd82d
SHA512411737be53feaef0829190b6610c729b925949bcc0b4a65063ab393acb1a92c577093e6377a373704ce54d27a593f2faddc23c80c660638f7c304a93f1972c93
-
Filesize
26KB
MD58758044db9fce67ea2ad542f86e69e57
SHA160cc4d25ea4e17f676e8ac8be10b9dfe2f7ed67d
SHA2560c91b552dc6db19b6711e32cb8c9c604b60dc9d674be06cccb6adf08b4dbd82d
SHA512411737be53feaef0829190b6610c729b925949bcc0b4a65063ab393acb1a92c577093e6377a373704ce54d27a593f2faddc23c80c660638f7c304a93f1972c93
-
Filesize
10B
MD5b00c1a89b15effd3d1fb2de4fdc7bee5
SHA10c3a4f06bcd397d1d3a63ab2ca05e64cc7ae554d
SHA2560767fccea7e57d6427b0a9b440f28687f4b835409c5dcdeb337a479009222cd9
SHA512b50a3c1df331ecd7dbbd88c202c7b7b8fe6ece8df96249d88f40138952fb3c523f6f133a2d12daa2fd892643b53e4c19b39bcb16ef810f789c996e00bad03bc0