Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe
Resource
win10v2004-20240426-en
General
-
Target
2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe
-
Size
7.3MB
-
MD5
f8ab859bdc0b2f95aed1b44c27205eee
-
SHA1
362254c913b8f9ed506cc9135dfdd54b3858cb47
-
SHA256
2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482
-
SHA512
b2df37937a5b981c819587aa582e0bf2e585f424d4be40ee6321d5b12687705acbcb335516c5352b9a443f5773b4a5ffc409d771a1e7333be4f6d7c528284c2b
-
SSDEEP
98304:SmB9OWBVClfcaA1oZeSajfztbVCGQX4bME4bP8nQgMVQNKe5AJbI8D:Sg9OHi1oZepfxUGGNQNKe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2368 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Sounds\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe File created C:\Windows\Logo1_.exe 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe 2368 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2612 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 85 PID 3076 wrote to memory of 2612 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 85 PID 3076 wrote to memory of 2612 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 85 PID 3076 wrote to memory of 2368 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 86 PID 3076 wrote to memory of 2368 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 86 PID 3076 wrote to memory of 2368 3076 2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe 86 PID 2368 wrote to memory of 4696 2368 Logo1_.exe 88 PID 2368 wrote to memory of 4696 2368 Logo1_.exe 88 PID 2368 wrote to memory of 4696 2368 Logo1_.exe 88 PID 4696 wrote to memory of 1488 4696 net.exe 90 PID 4696 wrote to memory of 1488 4696 net.exe 90 PID 4696 wrote to memory of 1488 4696 net.exe 90 PID 2368 wrote to memory of 3424 2368 Logo1_.exe 55 PID 2368 wrote to memory of 3424 2368 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe"C:\Users\Admin\AppData\Local\Temp\2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E63.bat3⤵PID:2612
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1488
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5b3166b305391ff0707753b23e6ea4225
SHA190f45b353714c2fa75bf6fc7d34c7b760a12fe0f
SHA256528b16af9e651ffcc368ff7d0787d4096c8aaf60bef6cb8e9e921028aefea686
SHA51251d20e8b39c654f0a16b5d3c7aed498c3faced12f2908e884febb6f780ffde5b4b5c9cb164019de87111c01c51839ac2d87605c4b35b887de90961b398a2173c
-
Filesize
573KB
MD547fd19a57b03128c736fc2ff6d20ff63
SHA171223ce5c72427e4b81f6fc443a0d6c0f8c76ae5
SHA256ce2835620f122f183d9138679b8bb14d73174fb07ba3762be7ee34c04d27b81e
SHA512d9807b74448b4d0491c9b8a838f610bc39812affa1884d5eac3eb7503a45c2a76a13e2ae942b532e784cedf8c45d22f17f4aa004b65c10f9e83e04687dd82ee6
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize639KB
MD5c8d281da4c32df16eef470c27c8cb459
SHA100efc9f6844bfaa37c264b6452c6a7356638ab10
SHA256058c81e5a07f2c6c33cf28dff71d07ad8f179046108d945159957e891bfd9c62
SHA512e3c79e19f620068f668d4ebaa5097f1a95a30dabb8dce75f3787171dddbea9f684fc7ce8d1011a398f38084d7af96dd1ff9a02d25906aab9b13861b8363d24bb
-
Filesize
722B
MD5c327a5fb5bf243ded4204cad9a6cc552
SHA1ed307536bcba06958ef4a64eea78cc5bdd6ab641
SHA25677ee79beb45fd31626525697ab8ff444e63d8bf5761e967f81b02927e1e90eca
SHA512c174afb047c6736a7208e26d75389aab9e2fddd833e474f0f2b9e001d95a0f4868de3749151b0eb02220b2a5d7ce0ae2a3bc0ac0d3f6c2bcf5362bb6d3abb398
-
C:\Users\Admin\AppData\Local\Temp\2339ae1c976feb510370e75fd39c580c375774ed35fdf07d88efedc29081e482.exe.exe
Filesize7.3MB
MD5172b6d29b3cdcdf2b0b14332eb216161
SHA17534c39aecd8a968c8cdf34db4cb388d999a3065
SHA2563bb1c042bf917e6577be28edce3243628e9ce4245e9abbc2cc0196ccca26630c
SHA51271e4e14c689974821c0bb80637a53cd5234df0111b809612ac810846fe2ba9d288da20141455b984dd842c8343166f807f8da51e74b66fbe3aec181db72806ce
-
Filesize
29KB
MD5c1154eebf193b34d928ac7a0d4d1425b
SHA1e412ae088af8d3d6e268ae517e62dc7a7150bf2f
SHA256fd38739477bdd63484e50d2b995923ab7da929db7fa69532e3293d8406f64b54
SHA512017537aa4204c2c327024b4dc9bfa61a36a3f2b64a8898e890e83a33a83e237d2b9749e86b7517da5b265c331171e4054ea6d7cb594743b457821fac3d4f50ac
-
Filesize
8B
MD54192191c0ab0c3b88220ba22a15110f6
SHA19c0fb16b7f5184b30d6fbc59562c618dcc4bdbd2
SHA2562230f7e62213f6b9a4fd3f6b5dc957077d8fb4a16e56150c6323264457a057bf
SHA512fd583ce439c1e8c5401e67dee407c0b7d566a5339bf779a2b4d6ce81f433c93c977c3a78345f3f750c42d8abd2aeed4a3edba183115b3fade994daa273206bfd