Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe
Resource
win10v2004-20241007-en
General
-
Target
ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe
-
Size
52KB
-
MD5
881dd0fc2ef489a84a7aa3fdff69dcb4
-
SHA1
f8fadbb90370903714cfe1a2673f60c48fdb951a
-
SHA256
ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa
-
SHA512
ebdddca2bbc649f8cdfcb69abd2ba4566d3904dcc6fdefb1bd461c26873c0bf9f94a25fa5023a52101ed9ab7dbba7390b03c6ff069f71ffb668dcf1082842b90
-
SSDEEP
768:49Mn16GVRu1yK9fMnJG2V9dLEqgt6jpYU5ltbDrYiI0oPxWExI:49M13SHuJV9k6jWWvr78Pxc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 980 Logo1_.exe 4532 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings OpenWith.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe 980 Logo1_.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1556 OpenWith.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2664 wrote to memory of 500 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 83 PID 2664 wrote to memory of 500 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 83 PID 2664 wrote to memory of 500 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 83 PID 2664 wrote to memory of 980 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 84 PID 2664 wrote to memory of 980 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 84 PID 2664 wrote to memory of 980 2664 ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe 84 PID 980 wrote to memory of 372 980 Logo1_.exe 86 PID 980 wrote to memory of 372 980 Logo1_.exe 86 PID 980 wrote to memory of 372 980 Logo1_.exe 86 PID 372 wrote to memory of 4628 372 net.exe 88 PID 372 wrote to memory of 4628 372 net.exe 88 PID 372 wrote to memory of 4628 372 net.exe 88 PID 500 wrote to memory of 4532 500 cmd.exe 89 PID 500 wrote to memory of 4532 500 cmd.exe 89 PID 980 wrote to memory of 3456 980 Logo1_.exe 56 PID 980 wrote to memory of 3456 980 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe"C:\Users\Admin\AppData\Local\Temp\ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB323.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe"C:\Users\Admin\AppData\Local\Temp\ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe"4⤵
- Executes dropped EXE
PID:4532
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4628
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD598dd7c1511e132e59c9d441b3dbf987c
SHA136c7d00b0b524300f44a3b7da7b3415bfad369e4
SHA256afe966017bdbfb5195a6fdf32e2eab42aa7e332ac9c83a123db5daf1b3171aa3
SHA512959e4cc73a8c6ac67c004c29dee3bc71599059f2559502496eedc4a0b6d1773c3f5fdee8104f12d58fbc4ce66191bd1e786bb7ae706e93a0062657b986996409
-
Filesize
573KB
MD54aafd131a93af2ecf070c7c59e905e66
SHA1d97dc15b3f7bbe559886f3bea2879e83cecc6809
SHA25692925beb42af0a02fcd0b0cd89a2d8eb67556b173cb5eb391adb6fdd8ea1d11b
SHA5124bf8e9fb37162f9c04ca5b65910bf80fc0f63cc1d75cc0cae88415282750411a49a571be3661cb4f50724461e082617285ed9a68f10d7f716a919f06f564d190
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize639KB
MD5fe2fab2d4c843edc9198a7767e9842e3
SHA142d7effdc358db8ef6fc6afbb9f09141535b5d11
SHA2564c50aca6c5c15d52d26c69be9dce9e7a1020e233f44d4ad245c60ea355f1e8a8
SHA5128b8c5d11732e088ac444554482294f42ccd386ce88ea9d40c59beeb04800696713f118e6d60fe2378f666862e08a8a32c322d443d21b96121552b498fb9c5f14
-
Filesize
722B
MD5967f4e867521c3b79f0046f0077c779a
SHA14285425a3bc3a857fdab67980f812343e48aa58e
SHA2564593e90c7b8919b238e959785a20b5591d37eb64260ea2d9a3c4d642b545a63d
SHA512c59867aced7dc5339ec37a032c8872b5a6eb0100b6131bf4bae0526f609fd63956a615dd02573dfcf9da3a4c45aec91008dea625a03e7ff905b0189496a14268
-
C:\Users\Admin\AppData\Local\Temp\ccb5598576316f752c7d3155de78871f5e88eaa70fbf2ad689f83957d36f6aaa.exe.exe
Filesize23KB
MD53f9dbfee668294872ef01b90740b01d0
SHA199a4702b65485cd14736b1c2cdfb81b455dda01c
SHA25640b32fea1fcadcb2db369475e2bba58b0b83f5c3bb647e2e63877726c35a9f86
SHA5120113cec160d97ea0cce70860cc5b79b502d16191ee237a3abb84309499be193aa0127dbcb41fc05a90fa61484b061ec4332ad29a918db598e32fe832b74bd1e3
-
Filesize
29KB
MD54c513a4884d5671553b53e59a8c5149a
SHA157afa0c2f1936a9adc9ddcb007499472a8a37d6d
SHA2560413d2f733470a6ae51171bd9de1abe1034020f8951e2c9c10156188471f3df3
SHA5122ac965599f0d154c1af515bd102436247fb8a83f0b34d0d01cde2d2063802d07258b0cc022e04f62eb06e5c983ff0ee2df4e727a0214f930ecc9b9e7be4a7924
-
Filesize
10B
MD51603436fb34d76c51d66ab1816519131
SHA13d5dc4ccfe3cc992c253dccfccf66ea727f66bf6
SHA2569072a674ab684ff3ef851bf4f0fdc4118d2bcbe765282f38f3f6de4360057d60
SHA51230d89b59822313e4b281b8f63b959f36262b2b948cf38e6389e9a1a7517c7c239349a41de9e35c8cd27d6b852ab5349206c2fb85b631dc59fab5421d997dbd46