Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe
Resource
win10v2004-20240802-en
General
-
Target
3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe
-
Size
2.8MB
-
MD5
23e682f4cd8bb3e77a15ea3a9438d56e
-
SHA1
2b90e1c8f926753eca86897a746f1b62b757ef7f
-
SHA256
3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88
-
SHA512
607e922421f0dad25ad58e416c08f987091d5a7484ff20df7d5144cc4bd80d09bb445b1340dd2e6571d7a76e10aef064eb818e0e9f2f47aa719407d66fa67a9d
-
SSDEEP
49152:F7lbybaNvP+Y7PezVcKvgvIUXVD49aPW0YDEPcx+Goq3to:DbybaFiiKvgwW5m/Ul
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3340 Logo1_.exe 3964 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe File created C:\Windows\Logo1_.exe 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe 3340 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4592 wrote to memory of 4776 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 85 PID 4592 wrote to memory of 4776 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 85 PID 4592 wrote to memory of 4776 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 85 PID 4592 wrote to memory of 3340 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 87 PID 4592 wrote to memory of 3340 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 87 PID 4592 wrote to memory of 3340 4592 3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe 87 PID 3340 wrote to memory of 908 3340 Logo1_.exe 88 PID 3340 wrote to memory of 908 3340 Logo1_.exe 88 PID 3340 wrote to memory of 908 3340 Logo1_.exe 88 PID 908 wrote to memory of 5520 908 net.exe 90 PID 908 wrote to memory of 5520 908 net.exe 90 PID 908 wrote to memory of 5520 908 net.exe 90 PID 4776 wrote to memory of 3964 4776 cmd.exe 91 PID 4776 wrote to memory of 3964 4776 cmd.exe 91 PID 4776 wrote to memory of 3964 4776 cmd.exe 91 PID 3340 wrote to memory of 3568 3340 Logo1_.exe 56 PID 3340 wrote to memory of 3568 3340 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe"C:\Users\Admin\AppData\Local\Temp\3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFF.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe"C:\Users\Admin\AppData\Local\Temp\3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:3964
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:5520
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD51deff10e563b9243ef8ab1607d3e9e96
SHA1bca911a50c06d827af06024bf8ec172bc2f0a675
SHA256d188a3a1c4595a2b910632867c4f79041dadc0748cd636a4c855b0f57a8075b7
SHA512a981baca2e4fc86e61af065a5f8827b03cd774afd78cc33c0cc498802bc29a044ac302838395415a340659269ce94bf7543f7c476666903948ffd7102dc598fb
-
Filesize
570KB
MD5bbb502305006756349e7e9385abf401f
SHA1d2d01f6249b1f0ca39cd8c4658daa39ea1aed679
SHA256dcd2288dab8642facd580aa10a605ddd3531268916c94838b86d496dd3a794d1
SHA512241049c1c0dad43b2e71d42d3a97aa70adeccb244713fdd5b91cb907fdb73bb2733276eb6fb466a745b2ca3f9af5599a9dae6bdc7ea94f0280717150c21d0a5b
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize636KB
MD52500f702e2b9632127c14e4eaae5d424
SHA18726fef12958265214eeb58001c995629834b13a
SHA25682e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
SHA512f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
-
Filesize
721B
MD59f2c8e601721a57e0185c232cb1bf33f
SHA1861a160ceb2a687dc8fb96e77d93cb9d670b2fb5
SHA256adf84ebd24bca765baaefa1afa0101d3047c174402ca02262f53a9df0936eb4f
SHA512e5aa678be9caaca549d26755c53325e75b79fefc8a747621695b84fff51ae019da221ea068bd524921ea6c3f3bd463cacc1fdd153f1e9fee749512022abbee36
-
C:\Users\Admin\AppData\Local\Temp\3fcffa0ad0d8d8b9dc47372872e106db12b82fdba724e1f57c0422abc5d3af88.exe
Filesize2.7MB
MD5e72c3792eeca960eb226ce7617af496e
SHA1313450b94d7992aeb75d6974befe640211bd4c0a
SHA256f7fb426e37a4dca83f0282b0414935ed7c34041d9399d2e653bc1db3db052c39
SHA51214f834719da9211197e7b64ce4e30436d91583fb244eecf992ad2fe394f5a0df5904ff3817c1c713bfa4baa49357df55f4e2a81e380a7dacca2ee313dffef31a
-
Filesize
26KB
MD5ef9a234000c71dec7218ebd161c31528
SHA1665974a14335eca0a7bfa7f31a9be5030bf648bc
SHA256019a31bff074fe18b08b5658fd9785b4ddda40f31cb22960b4763419d60832de
SHA5122a00ed53cb840fe75c2afa52e0f136d7fd1c0da4727e0d59961d839b6f6285cff93b462948ba3c01ac4fc1f815127ca976709f3ec2ce18495e01bde7098d1a8f
-
Filesize
9B
MD5fab909adf44de1f9f5c010f5b08064fc
SHA166c566239c73b8f0695b54a16d46a19f91a35530
SHA256da68d59f0202ebe993c367c926227dbf018434225163ab2f6121c12f2cdc5f65
SHA51201bd95ec2c9e61e637533d76965e8c81bfd4309a208cd823ee01158511e0e9db298e55c833c1a60732ddfedf085c157f70924b6a1550dc9297826186be547fad