Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
Resource
win10v2004-20240508-en
General
-
Target
bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe
-
Size
41KB
-
MD5
1913375580b62895ab8b610c734cc04c
-
SHA1
600fa438f355f803b13da1bb55066fea3c64f959
-
SHA256
bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92
-
SHA512
63fe4029d77bbcb7845dd6a4cb2c4ce5675512444722972bfe028edf4021ed75c728a15c077c8010d981bd7231d4f7a64cb17b7f0f2dc19bb8480b14a5cc3fb8
-
SSDEEP
768:sU16GVRu1yK9fMFLKaTxsujCT7pZpYIWQ3655Kv1X/qY1MSd:s+3SHmLKarIpYIHqaNrFd
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2700 Logo1_.exe 220 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Temp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\Fonts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe File created C:\Windows\Logo1_.exe bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe 2700 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2288 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 83 PID 1652 wrote to memory of 2288 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 83 PID 1652 wrote to memory of 2288 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 83 PID 1652 wrote to memory of 2700 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 84 PID 1652 wrote to memory of 2700 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 84 PID 1652 wrote to memory of 2700 1652 bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe 84 PID 2700 wrote to memory of 1692 2700 Logo1_.exe 87 PID 2700 wrote to memory of 1692 2700 Logo1_.exe 87 PID 2700 wrote to memory of 1692 2700 Logo1_.exe 87 PID 2288 wrote to memory of 220 2288 cmd.exe 86 PID 2288 wrote to memory of 220 2288 cmd.exe 86 PID 2288 wrote to memory of 220 2288 cmd.exe 86 PID 1692 wrote to memory of 4840 1692 net.exe 89 PID 1692 wrote to memory of 4840 1692 net.exe 89 PID 1692 wrote to memory of 4840 1692 net.exe 89 PID 2700 wrote to memory of 3372 2700 Logo1_.exe 55 PID 2700 wrote to memory of 3372 2700 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C9.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe"4⤵
- Executes dropped EXE
PID:220
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4840
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5970c9faffeef4a686a5e8a308a4800c5
SHA188c9365a2bf84bb7ee7695bef211f26eaf61e154
SHA2563ba0a07458d09c252ebe8d3ce4ee35c56605cda7e8a99cc07ea90caa334bf239
SHA51220031aba5855426a24c218e7ec09214addb9a58376f3a200b7a9de619efba860e319066b2b7992f6cbab617fcf947f8c39549789402128792c25bda23fd97334
-
Filesize
571KB
MD582afa7d29c6b5a174c20a46a82ca5373
SHA14ad982215dc0f60221ba3c14d4f5c7c11a4bf066
SHA25681e9aca35afcb1236486714ddb1c830e4a65af10eb00f735c01d41b1d65e1331
SHA512bfcdfe1474599e14b93ed4a0ecb891b7ddf46d17f41fb93f5f50a7a5aa49cd9ed6ea219f9e24f9c45bf590ee1a3e4c288b39a73510c8c9da06f2816b65d72a1a
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize637KB
MD59cba1e86016b20490fff38fb45ff4963
SHA1378720d36869d50d06e9ffeef87488fbc2a8c8f7
SHA256a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19
SHA5122f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765
-
Filesize
722B
MD594f955eaf1e7d4f7e4447e7c68c8f18c
SHA1b6eab3bc0b3d196340aa2a31e4c56636da2151a3
SHA256c89fde85e95f27afdc9eebdc3e3b328e8a34a34b388d87da2d80980f7503c724
SHA512f55dbff69d1b0850d41f7f4a9ba86bec4b193098306d16322377cc2286973d2be80dda86b88b5f0027053fc930c1e18c407bf6be3916dd4d003c3c4d6e3e57f5
-
C:\Users\Admin\AppData\Local\Temp\bc491264da8e771d4a54f8a1df664d2caf3d2b0ed5cc3ce8a9fa8421b97c8b92.exe.exe
Filesize14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
Filesize
27KB
MD5422eae1d27a7238ebf01a9a472b69126
SHA13db844e50f22bd66486eab06235effaeefc1ab5e
SHA25602f4bf41aa6efbc2a49158fe1da4dbfadc09b0ff26e0c9553b593d527e771ed6
SHA51236ce4fa5d259ba1e68dd097a154a6ba2bddf4ad37d563600eef0dfad80c08bd814720e29efd408c6ba2f0a87b28f8d275cc8b380295b93cf2affba4c905da526
-
Filesize
9B
MD5a470ca2426c102d035971b2e504d921b
SHA11720ef61e5c8e2ad6da9992a78940228fc81d615
SHA25613721d3153b316d1b54c64b67de19ae5147cb78e332448e6b800f6d510c269f5
SHA512c12907d26eac47d219aaa47b11d243738b0e698f898f9f2bd199652bc094197227ce12bc5fc96f5da25f1fd7b5904fe71ee3792105b05ac13a135d89aa1c1831