Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
Resource
win10v2004-20240611-en
General
-
Target
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
-
Size
563KB
-
MD5
667e85bd4dde4229556b4c184abc6315
-
SHA1
efca5158bccfd76802fa812678edd1efc332096f
-
SHA256
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d
-
SHA512
7e3db649c845d78fc995347adfba86f575ecdd7a7e42d783a12990abaf8a9af1a1e483b60dd548521ab21ee074ed07fb01e3d79bca5db08e41d3609407fc318f
-
SSDEEP
12288:x7+HLc+Gl3DflwlLrfw+fZdI+eN9K61cNiSvSGtTnOmyMcp7YJhne:x72c+qILkOdIdcN/vvtTObMceJhe
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4420 Logo1_.exe 2064 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe File created C:\Windows\Logo1_.exe b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe 4420 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3820 wrote to memory of 4048 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 83 PID 3820 wrote to memory of 4048 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 83 PID 3820 wrote to memory of 4048 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 83 PID 3820 wrote to memory of 4420 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 84 PID 3820 wrote to memory of 4420 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 84 PID 3820 wrote to memory of 4420 3820 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 84 PID 4420 wrote to memory of 1508 4420 Logo1_.exe 85 PID 4420 wrote to memory of 1508 4420 Logo1_.exe 85 PID 4420 wrote to memory of 1508 4420 Logo1_.exe 85 PID 1508 wrote to memory of 4956 1508 net.exe 87 PID 1508 wrote to memory of 4956 1508 net.exe 87 PID 1508 wrote to memory of 4956 1508 net.exe 87 PID 4048 wrote to memory of 2064 4048 cmd.exe 89 PID 4048 wrote to memory of 2064 4048 cmd.exe 89 PID 4420 wrote to memory of 3556 4420 Logo1_.exe 56 PID 4420 wrote to memory of 3556 4420 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C6D.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"4⤵
- Executes dropped EXE
PID:2064
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4956
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD514ade88c5dc82b0bfa12f95ef44d65e8
SHA17ec030c11b167d19fbbdc0283ad581593f3e0c68
SHA2564eed98e322b4876e43df6d22b1cd2c7ffd4e7b0ca4fdf4e1d512c040889f6e50
SHA512c9af793ec2a3b508d17e63f3ebe82a021a9f45849ea90473befdd4739a5536b6a08326214870aa7315bfa2e36b06629b8d6e4746e20260108cd9a608c5157eff
-
Filesize
570KB
MD584be5c759ef40c8af5aaa1b47840e22c
SHA1c95e4aeb83640d8742da50de7650689cbe6e220b
SHA2564ce1f8e708c7bdfb8d0842d4486df63c3caa61fead7658c281bc9fe13cc000b7
SHA512dc0f83d56c9883951690eceef0d9d7d15486cab5e71ca47bd0f21052799e7852a7cc0a7ed8c9e778cd7f474498670b3b6b3b83271dcdd360e96f4816f521cc25
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize636KB
MD52500f702e2b9632127c14e4eaae5d424
SHA18726fef12958265214eeb58001c995629834b13a
SHA25682e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
SHA512f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
-
Filesize
722B
MD5145834c33defa7553de41ffc0ff54933
SHA11dec32938e575a442054eb437591baf3ceafaac7
SHA2563e820c2ccc072f957f8f0e56baf5aa44d45344d30e84f033b57aed0a4991bca8
SHA512c5b694cd74cb7efc39912755980667a9a57bff653ad66d960c02f5d32698afb152375309cedc562f42518b75bd9c9d06c7e52ef701a8ddc6198e101797a856ae
-
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe.exe
Filesize537KB
MD51693ec6b9172f769440a61f39dc4ec23
SHA1784211d8def7e5047b16858773c1f898e853c761
SHA256d03eb23ef9eaf78e92d7db8febdd0c58bba0c8fa180af3ecb9112d7b5e02ddaa
SHA512059903839564e19b17d9e096db365c643079a68ace6e78b704810e81c57c04788621f987932c2947821ebda01cc3319c646dcde0d04f8cb736128debaade4df0
-
Filesize
26KB
MD502a751086e70575a0d1fd2ddb0c828f5
SHA153368acb3a3ec94af65b4fb645311ae861e15896
SHA256bd1b420c600a7fbd919550599f2521bc8100d716025ebec0872565bada4ab974
SHA5125cf5d7066eabb389373ab48945dc35c23175bd1172a951f18b88d1db80b4b244a78df62a1d30073eb69a31dcf8ef0fb30f61274a3fa7ff1ce56806b7852a08c9
-
Filesize
9B
MD57905486656bdf3fb568c8ea7abf7bda1
SHA149bd27ff3dcc248ecab0f726abb60ca35dc0e78c
SHA256238153572e1dcd784aa47b53eba4a41558719a908862c7b3d186928fb0237b09
SHA512b981b1fd177812b877c92b63b7261d2951b98871da87c20232cb70317a68694d7f7b24cf2f01bc3db01f192b2b8b84c7569a2472204ec4e66226d1efd14c9c14