Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 06:15
Static task
static1
Behavioral task
behavioral1
Sample
0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
Resource
win10v2004-20240226-en
General
-
Target
0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
-
Size
926KB
-
MD5
1a3a325061c8d7bc7efc9e3709c0120d
-
SHA1
e9f0edf40d6ce7705c713e82e637816afcf46dce
-
SHA256
0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d
-
SHA512
5ed1f79609a72d970f273292c096f8c18c9051b228412b091caa5675f981256512bbc4138393c44716bf5dc575bbbfce4c6dec89ebddcb3a44945bde72724c9b
-
SSDEEP
12288:U7+lIzIM4/h0cRjG/kvMTheu8WDY3HlHgUoSPL/W/ZlW+V1jrpduBgVXceR5+n1p:U7sX/h0cEnh8WD8lHvWjW+DXp6rwPu9Z
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2248 Logo1_.exe 2720 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ro-RO\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe 2248 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2396 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 92 PID 3016 wrote to memory of 2396 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 92 PID 3016 wrote to memory of 2396 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 92 PID 3016 wrote to memory of 2248 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 93 PID 3016 wrote to memory of 2248 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 93 PID 3016 wrote to memory of 2248 3016 0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe 93 PID 2396 wrote to memory of 2720 2396 cmd.exe 95 PID 2396 wrote to memory of 2720 2396 cmd.exe 95 PID 2396 wrote to memory of 2720 2396 cmd.exe 95 PID 2248 wrote to memory of 1364 2248 Logo1_.exe 96 PID 2248 wrote to memory of 1364 2248 Logo1_.exe 96 PID 2248 wrote to memory of 1364 2248 Logo1_.exe 96 PID 1364 wrote to memory of 1968 1364 net.exe 98 PID 1364 wrote to memory of 1968 1364 net.exe 98 PID 1364 wrote to memory of 1968 1364 net.exe 98 PID 2248 wrote to memory of 3332 2248 Logo1_.exe 57 PID 2248 wrote to memory of 3332 2248 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EDB.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"4⤵
- Executes dropped EXE
PID:2720
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1968
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:4940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570KB
MD5cdf329dfb35eba6f9f8334708e4862a5
SHA1b737a5ac4e62da9174760c8b8adf782dab5f9cdd
SHA256e5fd326ef628b19f87a5bf51f8bd04aa3583167e022b99e781b07d498077bc1f
SHA512083b3846dfb03bd6a8623c1f5001a184f4987fb66ac2b94bbc51b78f0ceb08146deb1abaabac6f852a92e5f1698f7cb526f5f74b1435fa8e2b90a0a4964d54f4
-
Filesize
722B
MD5ad05349c77a3c5a3a1be4702e000cb51
SHA1d886dd4eeb1f8ffca840cdbe7f2359b074823372
SHA256b02ccb4b6b5a93d32fa5a1e455cb7881ac1132af31546cb668d3ed088ad7532d
SHA512b52404aa128a747c67421bfe706bdd1ab63ed2a071ef132451644f27ede060a5444605684bfcb5c74995d21ce7b4e48a8184743cc873747f0dc2636dc663133d
-
C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe.exe
Filesize899KB
MD52cb5bc00421e0a0193169be2009d0022
SHA19a2754b0c2906dd64c1b2553246a232dc7c09bc1
SHA256f5591ec5909f8cd792c709a3772bdd4441243e673b703c4395d5755dbb638c76
SHA51235e1b408fe0c2f9b7dfc1e51ec9fe15029e53dd88a714e26c19f46711064e000f9bc44c1aef8adad3d647cd58bd5270202a2efd7f7fe30b6d1e1af028bae1cad
-
Filesize
26KB
MD5eae720ddb96259ba9cc84160c4e6db6b
SHA16e6aa6b84edda1752d2720be3269e5df9a7dbc91
SHA2561e3b3150146e34c2742aa0816cab9a3720ecb9f8e6ad85db6db8624ca6a57760
SHA512a386e5ebbe057131bfcbafcd14f2efe8cb486238394819e681feb1dc7fb5695df660cb2e6dc1ce3a944b1eabc365d91994ed1f137bde0a41d8a4c882428e7610
-
Filesize
8B
MD5d970a2bfcaa076939c06270d1a48dec8
SHA17a558f4d64c3e98bcfd2af83f28e6fbd207a39e1
SHA256bdc6872f9a0a011a670907f0fedad9b88e283c5af545cf9f6bd73c3709967d44
SHA512ea4c16930628455852ce343f8ae248b6df869b8da10b10928ebb802129f73d9761971811de317c7d3121b815340027782ec15d385d1d2d7df8fd0a46b62974c2