Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
203s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Resource
win10v2004-20221111-en
General
-
Target
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
-
Size
56KB
-
MD5
1061d59747c43b312f76dafa35c83e30
-
SHA1
087156122d65dc49bf8eff5468c363a998a87b89
-
SHA256
8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59
-
SHA512
1df8001454ad3c830261a7a51ef69e73485931ca8824d7b8eaab66ccaa1c87d85615ae4d2793555ab6529ebd8e7be377b6a42f96f2a2e235b10c70a82a4aa580
-
SSDEEP
768:pO16GVRu1yK9fMnJG2V9dHS8FY1st5LxI1Q4AwdVGWq0CVacOI+EfAympPvbr:pI3SHuJV9Na1O+GWq0CccR+eenbr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1492 Logo1_.exe 844 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe -
Deletes itself 1 IoCs
pid Process 1636 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1636 cmd.exe 1636 cmd.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe Logo1_.exe File created C:\Program Files\DVD Maker\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Minesweeper\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe File created C:\Windows\Logo1_.exe 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe 1492 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 960 wrote to memory of 1636 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 28 PID 960 wrote to memory of 1636 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 28 PID 960 wrote to memory of 1636 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 28 PID 960 wrote to memory of 1636 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 28 PID 960 wrote to memory of 1492 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 30 PID 960 wrote to memory of 1492 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 30 PID 960 wrote to memory of 1492 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 30 PID 960 wrote to memory of 1492 960 8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe 30 PID 1636 wrote to memory of 844 1636 cmd.exe 31 PID 1636 wrote to memory of 844 1636 cmd.exe 31 PID 1636 wrote to memory of 844 1636 cmd.exe 31 PID 1636 wrote to memory of 844 1636 cmd.exe 31 PID 1492 wrote to memory of 1104 1492 Logo1_.exe 32 PID 1492 wrote to memory of 1104 1492 Logo1_.exe 32 PID 1492 wrote to memory of 1104 1492 Logo1_.exe 32 PID 1492 wrote to memory of 1104 1492 Logo1_.exe 32 PID 1104 wrote to memory of 1332 1104 net.exe 34 PID 1104 wrote to memory of 1332 1104 net.exe 34 PID 1104 wrote to memory of 1332 1104 net.exe 34 PID 1104 wrote to memory of 1332 1104 net.exe 34 PID 1492 wrote to memory of 1220 1492 Logo1_.exe 13 PID 1492 wrote to memory of 1220 1492 Logo1_.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aE18A.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"4⤵
- Executes dropped EXE
PID:844
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1332
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5823a726c4d9cd4565fa917a392617480
SHA160721db9647be8a5c07df3d8d67cd82ffdae90f2
SHA2567c9b8076b659b03ec3076e37fa0a40837bf53f48ce1750e20ae23ce9133272ad
SHA512d5819675d31c8ad66b1bf21dd9f0145c54c79e188a46acade112f05e290e6751c84671c5eb9e05979ca6a0184eec8935201f270733b21abfa0888ad222971fa4
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08
-
C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756
-
Filesize
29KB
MD577705d80528f0563515f76450582bfa4
SHA1ce91c845049cbe7980acd5047956c84dbe2f58fe
SHA25604f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd
SHA51267b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756
-
\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08
-
\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
Filesize26KB
MD5d45503f138788a2fbff13aa4b0dac123
SHA1980166d3ef51cae11933cb398312686272dd8a18
SHA256280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72
SHA5122287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08