Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe
Resource
win10v2004-20240709-en
General
-
Target
269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe
-
Size
3.0MB
-
MD5
8d282225f46571f7f75b702f5f7e85ad
-
SHA1
72ea49277feec83f2b609ba32e6d5321ad55f7e6
-
SHA256
269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d
-
SHA512
668fe66324c211f207bbfae852a674e175575896abeac66c1a90567e66341828e6057b1fc7eef79f8d1d786129e41b464067196dd2fcba5b87c8fc59e8a1c8e5
-
SSDEEP
49152:87QIGwdA0g6CupcLp0pHwjOLaUIeJSBTXJeKPTSuN0o8hedRW9GoNeDJ:RIGH6CupcLp0pHnFSNXJ3TSW0oTW9jNq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2548 Logo1_.exe 2860 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe File created C:\Windows\Logo1_.exe 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 832 wrote to memory of 2196 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 84 PID 832 wrote to memory of 2196 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 84 PID 832 wrote to memory of 2196 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 84 PID 832 wrote to memory of 2548 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 85 PID 832 wrote to memory of 2548 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 85 PID 832 wrote to memory of 2548 832 269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe 85 PID 2548 wrote to memory of 3476 2548 Logo1_.exe 87 PID 2548 wrote to memory of 3476 2548 Logo1_.exe 87 PID 2548 wrote to memory of 3476 2548 Logo1_.exe 87 PID 3476 wrote to memory of 3756 3476 net.exe 89 PID 3476 wrote to memory of 3756 3476 net.exe 89 PID 3476 wrote to memory of 3756 3476 net.exe 89 PID 2196 wrote to memory of 2860 2196 cmd.exe 91 PID 2196 wrote to memory of 2860 2196 cmd.exe 91 PID 2196 wrote to memory of 2860 2196 cmd.exe 91 PID 2548 wrote to memory of 3468 2548 Logo1_.exe 56 PID 2548 wrote to memory of 3468 2548 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe"C:\Users\Admin\AppData\Local\Temp\269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC1C.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe"C:\Users\Admin\AppData\Local\Temp\269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe"4⤵
- Executes dropped EXE
PID:2860
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3756
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD5f2e9a510a40e521b50f6839eec63d3ed
SHA1e7586271acc3d0dfcc54e072c486fa6be319f46b
SHA256fee06a11569ff6b9c664f8dfce23e6f6e2d0e13d4405c5e7224a0c1cf551b9b7
SHA5126a67164ea999f16665f2928cdbd494ba8ea7c398e8cb190936b73b214ba5bd36ded4ab1f5d07938fe4af4e0984998745624be808fae06af8888fc74a6cb04f43
-
Filesize
570KB
MD51e505fc0d93301d1ba0b5b5f3a76467d
SHA17c9e293cbbbca5a82e564a1ee1c9bd0b3814e4c6
SHA25610cbd87bbf6dd1c99b7c0a3fd907b0dc7dffa09cdb6db77380d3caf501f59569
SHA5121ca8ff154fb426bc4692e132cad0148de0663aca919a0cfcf2e1c4aafedb5c971fb27b08343db91dac71dbb19b81a6076e17856e68e71385323c2a523262801b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize636KB
MD52500f702e2b9632127c14e4eaae5d424
SHA18726fef12958265214eeb58001c995629834b13a
SHA25682e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
SHA512f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
-
Filesize
722B
MD5772f2af63de7ea8e6ccdcb95d9b266cd
SHA155f9aed3e615ac94579277f45532fa6881a081e1
SHA256cf81c9e9b168fb017ae87eb5ead342fdcaf14eddd62104f6bf9b1a93a4c0c090
SHA512a7e2b4079444d831fca0611248bf898b74effce8866a57aec2df9848b9a33dd49c9cfe99550e303f12a5ca4ffa2edca3f7e18186bf8118d95e397fd83682918f
-
C:\Users\Admin\AppData\Local\Temp\269d22000aaa7278e3eb86dba01c1e9cced1911fccf7dcea84c7c59e9060397d.exe.exe
Filesize3.0MB
MD5946a34b9908db3f1c9a10d100ca74761
SHA1e2502980bfeee547bb38888af11d2e3ab764a1f8
SHA2566121bed8071607efe9743e2c5582395ebcac5cbab77da05d8120aa9d308d946e
SHA51284ff6a78c80b36db6ef55c7df51bc7432cf83752c33e4c5e7a88fa540d2f7fe26ed47b5bb5bf16a768e087fd1633e65f841b591cc39c0b7f1f18b40cbc3506a3
-
Filesize
26KB
MD5f352e9f0f79f4824907e742caa681192
SHA1e966dd9264543e3425ff991228fc2800f92fdd70
SHA25623f5e80fd82e45a3133287609845215b73d8e2be13a65b0e116185e7531a2766
SHA51211c22a372dba41cef48f07a3dc608cbd7fb5c3e3dd5effc977c6339709f1e26a8e4395cee61fd3b29cb264b69cffebd989ae084c551cbf7cd4650185a1fb3513
-
Filesize
9B
MD52efce5174bcf8d378a924333f75e26ad
SHA14fe6e1d729b55d42eb9d74aca11b36a94402de14
SHA25604ccb9bec2864153c72852867d8e65dca07eca4e5edcfb4beb62cb364dcd91fa
SHA51224684969632fb0562a3a7a5fec91d869d627730d8e9d83a2b17e326d7047e3fbff205eec207914e42ecd50fef68a212c19f3599ded271c00e66acc22f1f04c16