Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe
-
Size
132KB
-
MD5
e9189581342f1140180bb5368ae2edde
-
SHA1
3576bb622860757dcb4a6009c51fc33b245d2dd7
-
SHA256
574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f
-
SHA512
623c4579c24fdddb0042708bf30eb139243031849b2241fba2adb74c433f27ce0e2a5ad174f5cb406988f90ee8a8fd3bab6c9d0af86b1061870a727336d622c0
-
SSDEEP
3072:xAyLd0K/JdOebFhcYfWLI2d/1Fb5eOBpY2Ss4t:XLZ/JdEVM+deOBbSJt
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3640 Logo1_.exe 1052 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe 3640 Logo1_.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3656 wrote to memory of 756 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 83 PID 3656 wrote to memory of 756 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 83 PID 3656 wrote to memory of 756 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 83 PID 3656 wrote to memory of 3640 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 84 PID 3656 wrote to memory of 3640 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 84 PID 3656 wrote to memory of 3640 3656 574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe 84 PID 3640 wrote to memory of 5084 3640 Logo1_.exe 86 PID 3640 wrote to memory of 5084 3640 Logo1_.exe 86 PID 3640 wrote to memory of 5084 3640 Logo1_.exe 86 PID 5084 wrote to memory of 4260 5084 net.exe 88 PID 5084 wrote to memory of 4260 5084 net.exe 88 PID 5084 wrote to memory of 4260 5084 net.exe 88 PID 756 wrote to memory of 1052 756 cmd.exe 89 PID 756 wrote to memory of 1052 756 cmd.exe 89 PID 756 wrote to memory of 1052 756 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe"C:\Users\Admin\AppData\Local\Temp\574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92CA.bat2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe"C:\Users\Admin\AppData\Local\Temp\574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe"3⤵
- Executes dropped EXE
PID:1052
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4260
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
750KB
MD5e6e190e064db7c8e5273f82ed35d19b9
SHA16d6699b8c94c75b43e9da29dc016e62ea8e177ef
SHA256580975fc1e9fba8dc711a41013a636ba441007c1d4d3791ffe5f6ddaa4aed8d4
SHA512d34a357044db116d6ed312579d1ba1e58646aed8014cae207b390aad8b99e6e3d923df158a4681db22c749af937041747e9fa8814927c32942a335dd2cef8fe3
-
Filesize
722B
MD5476deff0e32f31ccef8e633d2db9f8d1
SHA1116df707c2f011aa7053dda98c6a912a005e6435
SHA256c09689115487768fae9f8d4a73fd54b1c5f1c402f2abaf678953a473c87baa67
SHA5123482c789d33e848ddf016313bee886644b6f8765ea61308202ae95ef3207c279a2531f57ff34f9c9833f1b3ebb039e20bcb79e7d7a54b9ba240d68518928ad4b
-
C:\Users\Admin\AppData\Local\Temp\574125e2c04d2b76c5738c95efbb3f59f9c3219c729eb8ec093744361420aa3f.exe.exe
Filesize66KB
MD57255c3ac9f65161062fe5161bb743a5f
SHA1f9965b2c29fe9a9d236ec60920657dc2ed7f869f
SHA25620e74d12502aae815b3d23956792c87a10a57cab0752fc968b9917360436f072
SHA512ab85a02b8bf22fe0b4e79eca8b6f1bef7f30f6faed15d2565ee9a99d2452262d45ce6297b571f7db5711bd7a0beda59b1d3d9d6864dd9028dcce079607f0f646
-
Filesize
66KB
MD53df5852b7f00b2d927fd157fe3ab9d7b
SHA1405b1d2054eb357133bd5019c749f07d8ebae9ba
SHA256717c8d0200f827fd26f0759f16cf562cb417c5e25d3fd464ca9cd7b1b1a80ffb
SHA512b82e7054cd24e9577fd24ec5228bb8271ee34a5cdcfd7a269cbbabc4d843f5bbfafaafe4f46891f8dfceaf543a9c286243558e9c521574b41eca3e77c17ee0c2