Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 03:32
Static task
static1
Behavioral task
behavioral1
Sample
a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe
Resource
win10v2004-20220812-en
General
-
Target
a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe
-
Size
248KB
-
MD5
72de072b89b4d53079beaf16c4b50e28
-
SHA1
57b60afcfee6cf8089234884b25a3041f4ee14a4
-
SHA256
a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876
-
SHA512
d8e88814edd11641d84a28e3c546dbece75e9a9a03fecbb2c2066ec2fb7dc00df3e100079d28c1276f20ccd4529deb4ad28ebc800c7daada41fd6d5b49c773c8
-
SSDEEP
6144:7uJ//26kJC3oghja3DpYGaYxKrNV0eS0HeMQTtF:lC4gNobaYoN2eS0WZF
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 976 Logo1_.exe 624 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe -
Deletes itself 1 IoCs
pid Process 1696 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1696 cmd.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE Logo1_.exe File created C:\Program Files (x86)\Windows Defender\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe File created C:\Windows\Logo1_.exe a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe 976 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 852 wrote to memory of 1696 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 27 PID 852 wrote to memory of 1696 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 27 PID 852 wrote to memory of 1696 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 27 PID 852 wrote to memory of 1696 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 27 PID 852 wrote to memory of 976 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 29 PID 852 wrote to memory of 976 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 29 PID 852 wrote to memory of 976 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 29 PID 852 wrote to memory of 976 852 a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe 29 PID 976 wrote to memory of 1020 976 Logo1_.exe 30 PID 976 wrote to memory of 1020 976 Logo1_.exe 30 PID 976 wrote to memory of 1020 976 Logo1_.exe 30 PID 976 wrote to memory of 1020 976 Logo1_.exe 30 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1696 wrote to memory of 624 1696 cmd.exe 32 PID 1020 wrote to memory of 1332 1020 net.exe 33 PID 1020 wrote to memory of 1332 1020 net.exe 33 PID 1020 wrote to memory of 1332 1020 net.exe 33 PID 1020 wrote to memory of 1332 1020 net.exe 33 PID 976 wrote to memory of 1280 976 Logo1_.exe 18 PID 976 wrote to memory of 1280 976 Logo1_.exe 18
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe"C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a2BA3.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe"C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe"4⤵
- Executes dropped EXE
PID:624
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1332
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD51afc514cd2476221fa658a970ac077ef
SHA16b127e185d3c65f2ed9155269df87647dd276e3b
SHA256e229712559c121334db5fbae0ffd0af5fe54312d545a24660166fc2a64d7c340
SHA512269a702c9d3ae4c96127fbe0dd54019e60f864b104e48401f284ddb62fb7d7609a2cb1c53d216c28f870a89e5882a06da2951a68078fdb243bb73da5aaf7000c
-
C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe
Filesize219KB
MD5547ad163f7a06703b439d11c4710d53a
SHA1e22644fb3321d031111b018899fbb3b8fa51a2e1
SHA25621bfa40ebac55a0195dd0323aaba6eab25a4acd49ad3b6252ed77a5556c4928e
SHA51201e30945f77f60f25111d5dc7af858876e6ffc3a84071c1917ffd4b7bff19aa9c7b0cc053aa99d41ba370063bfae6308f040b13f368d31abad1ad0e405b0d51e
-
C:\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe.exe
Filesize219KB
MD5547ad163f7a06703b439d11c4710d53a
SHA1e22644fb3321d031111b018899fbb3b8fa51a2e1
SHA25621bfa40ebac55a0195dd0323aaba6eab25a4acd49ad3b6252ed77a5556c4928e
SHA51201e30945f77f60f25111d5dc7af858876e6ffc3a84071c1917ffd4b7bff19aa9c7b0cc053aa99d41ba370063bfae6308f040b13f368d31abad1ad0e405b0d51e
-
Filesize
29KB
MD5b74ebaff81a1ab6d6d71795c0c5247d4
SHA108e8ed0b70413dda93bac71087cebdda93a8f9a3
SHA2560b6419cc4ffd5710dab5b08c41c9aa240f104680e76a4fdf2d4d57110b0a9922
SHA512fae8d2097638ace772e806dc1a5de7619cb13b6cbbab6c0484178711c07d68b482e0c502fcc0322fedbb06dd1dd781dffa8b0dd68fc8cedcb68c60a3b01d7946
-
Filesize
29KB
MD5b74ebaff81a1ab6d6d71795c0c5247d4
SHA108e8ed0b70413dda93bac71087cebdda93a8f9a3
SHA2560b6419cc4ffd5710dab5b08c41c9aa240f104680e76a4fdf2d4d57110b0a9922
SHA512fae8d2097638ace772e806dc1a5de7619cb13b6cbbab6c0484178711c07d68b482e0c502fcc0322fedbb06dd1dd781dffa8b0dd68fc8cedcb68c60a3b01d7946
-
Filesize
29KB
MD5b74ebaff81a1ab6d6d71795c0c5247d4
SHA108e8ed0b70413dda93bac71087cebdda93a8f9a3
SHA2560b6419cc4ffd5710dab5b08c41c9aa240f104680e76a4fdf2d4d57110b0a9922
SHA512fae8d2097638ace772e806dc1a5de7619cb13b6cbbab6c0484178711c07d68b482e0c502fcc0322fedbb06dd1dd781dffa8b0dd68fc8cedcb68c60a3b01d7946
-
\Users\Admin\AppData\Local\Temp\a930b5698e8c74b31cf13d47611ad192aa841516e9ba35b4ff1645b59debe876.exe
Filesize219KB
MD5547ad163f7a06703b439d11c4710d53a
SHA1e22644fb3321d031111b018899fbb3b8fa51a2e1
SHA25621bfa40ebac55a0195dd0323aaba6eab25a4acd49ad3b6252ed77a5556c4928e
SHA51201e30945f77f60f25111d5dc7af858876e6ffc3a84071c1917ffd4b7bff19aa9c7b0cc053aa99d41ba370063bfae6308f040b13f368d31abad1ad0e405b0d51e