Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
27/08/2023, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe
Resource
win10v2004-20230703-en
General
-
Target
e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe
-
Size
1.6MB
-
MD5
7213bf8b91f8f15163f1775bc0cb8b5d
-
SHA1
f1c6db7fc09f6cb66815cd35644f1ad4036b4a57
-
SHA256
e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8
-
SHA512
7d9f3f9030b9e22cbc96b56a2ed61b5cc91108264a4129f7d69b8f02027af1ff8c605bb373344fb95300c07538c24b7180e9e403b3263006ac0478e56c8e675c
-
SSDEEP
49152:B7Gb1VYXE4PPYyLOu2/+G9BJS8qYlZWEYWwP:yADHYyLOu2/B9BJSnYXWEYWw
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2476 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1204 Logo1_.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe -
Loads dropped DLL 1 IoCs
pid Process 2476 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe 1204 Logo1_.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 748 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2476 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 28 PID 2924 wrote to memory of 2476 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 28 PID 2924 wrote to memory of 2476 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 28 PID 2924 wrote to memory of 2476 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 28 PID 2924 wrote to memory of 1204 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 30 PID 2924 wrote to memory of 1204 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 30 PID 2924 wrote to memory of 1204 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 30 PID 2924 wrote to memory of 1204 2924 e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe 30 PID 1204 wrote to memory of 2188 1204 Logo1_.exe 31 PID 1204 wrote to memory of 2188 1204 Logo1_.exe 31 PID 1204 wrote to memory of 2188 1204 Logo1_.exe 31 PID 1204 wrote to memory of 2188 1204 Logo1_.exe 31 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2476 wrote to memory of 748 2476 cmd.exe 33 PID 2188 wrote to memory of 1524 2188 net.exe 34 PID 2188 wrote to memory of 1524 2188 net.exe 34 PID 2188 wrote to memory of 1524 2188 net.exe 34 PID 2188 wrote to memory of 1524 2188 net.exe 34 PID 1204 wrote to memory of 1368 1204 Logo1_.exe 12 PID 1204 wrote to memory of 1368 1204 Logo1_.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe"C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aD3D3.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe"C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:748
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1524
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD513170cac3930f5319da800ee7788694a
SHA106f3ef4ac59d648ee3863c94dec90a752be4242f
SHA256a7239e8fffbe999b921e793854fcdd0ad084b6d33e3cefc7f4e255647961eb5e
SHA5123d0cc618d88afefe107be759784d9f7e2eddc7cb4b312a523fb7f9155e8e7d4050f4c8b92df39c8255d69f3c2518616604a77ae3587a752e77732b2583a57a69
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5b7e4f9dd58bcbb190dabe4c604ff7d4a
SHA197bca18dfae12ecc081fd75dde77f18615666a6e
SHA25692d74533d4ba984f5cb11d739e79e57402dbbbc593f2d28465cf94b8b56b7cac
SHA512f77eb9f18de2ef2f54ae27969cd6522a638d1f318873a602df9d0e3655e71ed61397a575b5dc30a2bfeacc3712b0295804ecd441c5a08da7fdfd6b123f782ffb
-
Filesize
722B
MD5b7e4f9dd58bcbb190dabe4c604ff7d4a
SHA197bca18dfae12ecc081fd75dde77f18615666a6e
SHA25692d74533d4ba984f5cb11d739e79e57402dbbbc593f2d28465cf94b8b56b7cac
SHA512f77eb9f18de2ef2f54ae27969cd6522a638d1f318873a602df9d0e3655e71ed61397a575b5dc30a2bfeacc3712b0295804ecd441c5a08da7fdfd6b123f782ffb
-
C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe
Filesize1.6MB
MD5293c178f1f54acd475fd7fdac3b48d8e
SHA14d71e9d9a0abca70893c0c8462bfcce894085ba6
SHA2566b67e684e4d3b9a10e0e6059faf254e4ca4d0467dfe9671a3f37fccef236755d
SHA51215da5cddb49cd24ec3fee6eade926b78cf48f9e4091cbf8574c8dd278e176001b993c2cc5c377b2a1f44e46b0e7b34e72eb21b1b20142eed604520b751dc20db
-
C:\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe.exe
Filesize1.6MB
MD5293c178f1f54acd475fd7fdac3b48d8e
SHA14d71e9d9a0abca70893c0c8462bfcce894085ba6
SHA2566b67e684e4d3b9a10e0e6059faf254e4ca4d0467dfe9671a3f37fccef236755d
SHA51215da5cddb49cd24ec3fee6eade926b78cf48f9e4091cbf8574c8dd278e176001b993c2cc5c377b2a1f44e46b0e7b34e72eb21b1b20142eed604520b751dc20db
-
Filesize
26KB
MD5a5484ba2d9c923b19401adf03d3b7be1
SHA19ee1a5f209a6ce1db5de3d29870cf52a069f7c21
SHA25645ac83f04bf5118d80787103c73eb3619ba52873666906c013857ffca1704072
SHA51276511539e8940dea07aba383da823d747942658bfc03fd401c192f8a541d2253f12430aafa12853ec71c12dbf62ef666fe55bcdefc2a2cb254a821a84158034f
-
Filesize
26KB
MD5a5484ba2d9c923b19401adf03d3b7be1
SHA19ee1a5f209a6ce1db5de3d29870cf52a069f7c21
SHA25645ac83f04bf5118d80787103c73eb3619ba52873666906c013857ffca1704072
SHA51276511539e8940dea07aba383da823d747942658bfc03fd401c192f8a541d2253f12430aafa12853ec71c12dbf62ef666fe55bcdefc2a2cb254a821a84158034f
-
Filesize
26KB
MD5a5484ba2d9c923b19401adf03d3b7be1
SHA19ee1a5f209a6ce1db5de3d29870cf52a069f7c21
SHA25645ac83f04bf5118d80787103c73eb3619ba52873666906c013857ffca1704072
SHA51276511539e8940dea07aba383da823d747942658bfc03fd401c192f8a541d2253f12430aafa12853ec71c12dbf62ef666fe55bcdefc2a2cb254a821a84158034f
-
Filesize
26KB
MD5a5484ba2d9c923b19401adf03d3b7be1
SHA19ee1a5f209a6ce1db5de3d29870cf52a069f7c21
SHA25645ac83f04bf5118d80787103c73eb3619ba52873666906c013857ffca1704072
SHA51276511539e8940dea07aba383da823d747942658bfc03fd401c192f8a541d2253f12430aafa12853ec71c12dbf62ef666fe55bcdefc2a2cb254a821a84158034f
-
Filesize
9B
MD5c0232c2f01c543d260713210da47a57b
SHA163f2c13c2c5c83091133c2802e69993d52e3ec65
SHA256278e1b8fd3f40d95faaecf548098b8d9ee4b32e98a8878559c8c8dfcd5cd1197
SHA5122ccfd67393a63f03f588296bb798d7a7d4ec2ea5d6ac486cb7bdf8a5a66b1df944d8b548f317e58bfe17dea2ae54e536ffe77bc11a43c931f3d10e299ab3fca0
-
\Users\Admin\AppData\Local\Temp\e62991b717736d26ca75d7392df5a55a7e4d6bc0a1bab7d2cb824018671c35d8.exe
Filesize1.6MB
MD5293c178f1f54acd475fd7fdac3b48d8e
SHA14d71e9d9a0abca70893c0c8462bfcce894085ba6
SHA2566b67e684e4d3b9a10e0e6059faf254e4ca4d0467dfe9671a3f37fccef236755d
SHA51215da5cddb49cd24ec3fee6eade926b78cf48f9e4091cbf8574c8dd278e176001b993c2cc5c377b2a1f44e46b0e7b34e72eb21b1b20142eed604520b751dc20db