Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe
Resource
win10v2004-20240508-en
General
-
Target
ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe
-
Size
573KB
-
MD5
89e33c39bc576ce1475c2b77dfbd26ab
-
SHA1
141426cc4624a52ab9903dd59c964d9e2b96f591
-
SHA256
ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5
-
SHA512
873cf261ef4ece65c1f8f2084d6a9571f736d39e0f63de64beaeb8a3f1c583308872dbad450e3ca404416f882c8b8a705bb89194eba9a2c157f7bdf97fb7e138
-
SSDEEP
6144:OuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:G7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3988 Logo1_.exe 1352 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Temp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\EnsoUI\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe File created C:\Windows\Logo1_.exe ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe 3988 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2396 wrote to memory of 4252 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 80 PID 2396 wrote to memory of 4252 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 80 PID 2396 wrote to memory of 4252 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 80 PID 2396 wrote to memory of 3988 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 81 PID 2396 wrote to memory of 3988 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 81 PID 2396 wrote to memory of 3988 2396 ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe 81 PID 3988 wrote to memory of 3640 3988 Logo1_.exe 83 PID 3988 wrote to memory of 3640 3988 Logo1_.exe 83 PID 3988 wrote to memory of 3640 3988 Logo1_.exe 83 PID 3640 wrote to memory of 4364 3640 net.exe 85 PID 3640 wrote to memory of 4364 3640 net.exe 85 PID 3640 wrote to memory of 4364 3640 net.exe 85 PID 4252 wrote to memory of 1352 4252 cmd.exe 86 PID 4252 wrote to memory of 1352 4252 cmd.exe 86 PID 3988 wrote to memory of 3440 3988 Logo1_.exe 56 PID 3988 wrote to memory of 3440 3988 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe"C:\Users\Admin\AppData\Local\Temp\ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39EC.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe"C:\Users\Admin\AppData\Local\Temp\ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe"4⤵
- Executes dropped EXE
PID:1352
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4364
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD56dbfa871d18aa4c685e00f03cc40e191
SHA1ef9dba44feb63da5dcc1859ea9705622b2cee7bc
SHA25633d8e5692cce3bda96d8788ed5fb77cec05be84e18c511df639e13cd6062d6a8
SHA512cacf2c539ef66fa01408d568a35c9b556e2e4fc7687e0e8371d5a3906722603f2853792cf3468e4fca1432e809569dfd80b21edb54ac2c747a78e454c67e45c1
-
Filesize
573KB
MD589e33c39bc576ce1475c2b77dfbd26ab
SHA1141426cc4624a52ab9903dd59c964d9e2b96f591
SHA256ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5
SHA512873cf261ef4ece65c1f8f2084d6a9571f736d39e0f63de64beaeb8a3f1c583308872dbad450e3ca404416f882c8b8a705bb89194eba9a2c157f7bdf97fb7e138
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize639KB
MD59fdceacc59188df6bcccdf4c6987820a
SHA1f492a0cb2db22317746eb136e56621e5801c97ab
SHA256a3752dc6d1984857f3fa949c4ce20b2847d009f865216f4c7e31d3f01183938c
SHA5123c81e2d7915868a2e88a97fbdf67d5fae8924f52ae497598333607367e642630c3b4c6085a3b8110814d997a9a13c341b2c5c5d336951484b3cbaa68479ad5c9
-
Filesize
722B
MD58644cf1c9f3e4c7fb6bf4f95223ce896
SHA11ee807f255298c3de1e4cef3c8202bc65dddf975
SHA256b4852ea91cefa485fb5b1a5a64aad07dfba6851e8ad5a4822e3f43f94df0c4e5
SHA5122a3ae4b8875f0f73fd7b769f12f03d84429b7b9d77281a3fd68c15f9a63248ba0bf636e1b4b1fb928ed36de370da84f6de0f23576f9dc04d4cb13f9ec31be748
-
C:\Users\Admin\AppData\Local\Temp\ea5263d89b8b9492c89bfd163417001f5237576e2ec7c5bead195a396a0184a5.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
29KB
MD5693e6f028a3f9f068a0b5e7250537d55
SHA12c79b8c2a6f4ebac7bf248a36d561fdc2b3532ff
SHA256862b4192b217938a0a759e4ff19510ba65521b62927794e45a13b666ac90be72
SHA5123645bc60a4185bc11f698608b757bd8d1181c7bba3b0ff801df0c40b9c721acab28352c947a4f93647fec238616af0b43f1f1d7a066617ddbe1c1eed858d5d4a
-
Filesize
8B
MD5d970a2bfcaa076939c06270d1a48dec8
SHA17a558f4d64c3e98bcfd2af83f28e6fbd207a39e1
SHA256bdc6872f9a0a011a670907f0fedad9b88e283c5af545cf9f6bd73c3709967d44
SHA512ea4c16930628455852ce343f8ae248b6df869b8da10b10928ebb802129f73d9761971811de317c7d3121b815340027782ec15d385d1d2d7df8fd0a46b62974c2