Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe
Resource
win10v2004-20240226-en
General
-
Target
6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe
-
Size
2.8MB
-
MD5
bed10402647b0c71e83f2308d35f7c24
-
SHA1
33aea471a0c92330d4a7297e3862e532a0368a1d
-
SHA256
6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319
-
SHA512
e0fec39571c0795d9dd7f261fa1ec5352d11d1d496fef4f8bf030aacfd9d9cc62e6849b5672824ae094e6b65c6f5aa71c3126fe6de8002ce9e2be6bf91a4b738
-
SSDEEP
49152:X7T6gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:Kd1XdhBiiMa7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3284 Logo1_.exe 660 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\TagAlbumDefinitions\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe 3284 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 60 wrote to memory of 1792 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 88 PID 60 wrote to memory of 1792 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 88 PID 60 wrote to memory of 1792 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 88 PID 60 wrote to memory of 3284 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 89 PID 60 wrote to memory of 3284 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 89 PID 60 wrote to memory of 3284 60 6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe 89 PID 3284 wrote to memory of 2232 3284 Logo1_.exe 92 PID 3284 wrote to memory of 2232 3284 Logo1_.exe 92 PID 3284 wrote to memory of 2232 3284 Logo1_.exe 92 PID 2232 wrote to memory of 4636 2232 net.exe 93 PID 2232 wrote to memory of 4636 2232 net.exe 93 PID 2232 wrote to memory of 4636 2232 net.exe 93 PID 3284 wrote to memory of 3388 3284 Logo1_.exe 42 PID 3284 wrote to memory of 3388 3284 Logo1_.exe 42
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe"C:\Users\Admin\AppData\Local\Temp\6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51BA.bat3⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe"C:\Users\Admin\AppData\Local\Temp\6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe"4⤵
- Executes dropped EXE
PID:660
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4636
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD572b78c7a0f4ed4969a8f107c0a03ec2a
SHA19d2c36fd60c6f5da7f2b53c00c0dd19f8f1734e3
SHA2565ac58be3e267a5eaaf7eb8fe78e96254f37f6bffd1b203f0c7e2cc010f363f9d
SHA512041ec2c15e297de846292a13b4af32d2a6f884e279fb9b387c12407ca756e80224c9319fbfd830e01b398991c139aeaf7bd30c7127bac3e8f1ec80fb9b3b5cc8
-
Filesize
570KB
MD550f006b4784abbc5f9a2f7af1c8aa88b
SHA1e600e94b110072573ea7d94034cc5ce2804572e0
SHA2567ffe33e9377a9784954a7b93f2596751f99b0a4301fa8ad2824b8c3fea1c02d2
SHA512b90e9150b3425fa17c98a0bd35713b65fb167c50ca45f8a21ebb16d835812fb6c4aaaeb7be2e9958d887c326414ccf8331ba3e6b3ca64e8c4b607e8625f5b48d
-
Filesize
481KB
MD5fcdc8cc5a6bdd2a9a0419a63c6fd22c0
SHA15386e28b9c3ef4aa6624f56932a620953bb65929
SHA256700e37131587c29a553d547c5601cbff1c1d10de872dd597e11d81f11741516c
SHA5125c170786968afb102bbe67d98d89934a6f9346f5e5a29036d52456bb0f7dd12e194579d8abb4358f02051074a3555a58599ee1176095adb3110eda6c39168e4c
-
Filesize
722B
MD51e6c199e21ccbe5e92af6ac8b3d990ef
SHA1c06087c5552ff75a941f5c1476c2e6472389e93b
SHA25600c9d15977c6f22f797b6b8f396d22d99e99e120cacf03037602b18fb74ddb94
SHA512bd2870d2cd69263eca50ad439094014bcfa8bb275991b83b2b2023cd5672b560c8a54da266bd45b52f6c113d49b36ac67aad0b3c742f4e74a2cc03807fb83512
-
C:\Users\Admin\AppData\Local\Temp\6e2f218462b91bf437e52ef0f13779c7958d483c3918a6dea808878aa5693319.exe.exe
Filesize2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
Filesize
26KB
MD5117882df6beb3d0717ffa507994a5a45
SHA1ca627aa3bd403f618ba52df98f058bd17575a937
SHA2564a5e4f6790935a1b103d45a64f8677b8123d9a0bbb03fa6f62e4e27729f2d6e6
SHA512af76c06ed35e1d70766de56fb839529f9b3c0be1c14694aa63d7bf4f470a08815a679b74153563b85f0fddf56f4f2632e2ea1b88fa6e05ee709df5ce8cfad1a4
-
Filesize
9B
MD520579de1c6702ea14f25df921a00274b
SHA1fc7299007b5fb0580c7a3ef6ae0efd8aaf80a35f
SHA2563eb24c26a19e67d7f499ccb30f78fc29bee126bafd13f41470223c1b8f2e1e4e
SHA512e9a21ede4321b86e5d215d41321741f8db22b9eb92c1325026182c688311d5134041102a194d670abcbd182d2c91d5180ac9b7c9daaf9e41109a3b3d8e3c3d81