Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Resource
win10v2004-20230915-en
General
-
Target
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
-
Size
122KB
-
MD5
d28d3d4d2d8c5cd938d85beada8ad680
-
SHA1
7279e7100d1e7ab52d1373062571fdc4c53feeb0
-
SHA256
472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2
-
SHA512
34fe40b7dced69e6d02a7510749f209aaa269705fbf330c71c878dd83b8278bb24880ebfda4ac7a9c44d264dbbd18240c1fc78ed99829fa7d62541c4214e1099
-
SSDEEP
3072:OftffjmNSoFHzg2I0PpPNX6RLXWertCQyyNU:2VfjmNvZzhPpPNq6QyH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2592 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3040 Logo1_.exe 2660 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe -
Loads dropped DLL 1 IoCs
pid Process 2592 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe File created C:\Windows\Logo1_.exe 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe 3040 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2592 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 28 PID 2224 wrote to memory of 2592 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 28 PID 2224 wrote to memory of 2592 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 28 PID 2224 wrote to memory of 2592 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 28 PID 2224 wrote to memory of 3040 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 29 PID 2224 wrote to memory of 3040 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 29 PID 2224 wrote to memory of 3040 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 29 PID 2224 wrote to memory of 3040 2224 472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe 29 PID 3040 wrote to memory of 2720 3040 Logo1_.exe 30 PID 3040 wrote to memory of 2720 3040 Logo1_.exe 30 PID 3040 wrote to memory of 2720 3040 Logo1_.exe 30 PID 3040 wrote to memory of 2720 3040 Logo1_.exe 30 PID 2720 wrote to memory of 2864 2720 net.exe 33 PID 2720 wrote to memory of 2864 2720 net.exe 33 PID 2720 wrote to memory of 2864 2720 net.exe 33 PID 2720 wrote to memory of 2864 2720 net.exe 33 PID 2592 wrote to memory of 2660 2592 cmd.exe 34 PID 2592 wrote to memory of 2660 2592 cmd.exe 34 PID 2592 wrote to memory of 2660 2592 cmd.exe 34 PID 2592 wrote to memory of 2660 2592 cmd.exe 34 PID 3040 wrote to memory of 1204 3040 Logo1_.exe 17 PID 3040 wrote to memory of 1204 3040 Logo1_.exe 17
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a7D5A.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"4⤵
- Executes dropped EXE
PID:2660
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2864
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD569f6da654a3a49de8590243642d590c3
SHA1f78aaa784459c8ae30c9a3c4d3859e2c865fa1f8
SHA25656be6a70c7a51c57f12564c5da636e21c3238a085f6dcdb3ffcb3d3e61d4ccc8
SHA5123bd6cf50d13e42ce4264c24b67bccf93e45d360bcecf496df62e22678dbccd8ddc774e575bcd83332fcdf13e2b8f6b4a40df30ec07decf5915dfdeedae21e684
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5a9db50e0143f879f9d70a01efcd47b7c
SHA1a238cc4b54fc5b4dec78f9b15c5299287de3cb54
SHA256a2c7faf7fe9c352373ab19bfef9f800543063b66fdf058f3d320d9a5bca6700b
SHA5128c21de84238e637276aa6f992d4d1aac885147015117ea70aed1b73c795db4ffdf4a21caeabeff60c2a4cbcd9132c1b83fd6ab319e5375f7153bfcd5f02c7264
-
Filesize
722B
MD5a9db50e0143f879f9d70a01efcd47b7c
SHA1a238cc4b54fc5b4dec78f9b15c5299287de3cb54
SHA256a2c7faf7fe9c352373ab19bfef9f800543063b66fdf058f3d320d9a5bca6700b
SHA5128c21de84238e637276aa6f992d4d1aac885147015117ea70aed1b73c795db4ffdf4a21caeabeff60c2a4cbcd9132c1b83fd6ab319e5375f7153bfcd5f02c7264
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Filesize96KB
MD54f777a9f156035ab4670da6cdcbd651c
SHA178b6f97056e6d5674bbcb94f13c4bf5527319c02
SHA25677a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8
SHA512244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437
-
C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe.exe
Filesize96KB
MD54f777a9f156035ab4670da6cdcbd651c
SHA178b6f97056e6d5674bbcb94f13c4bf5527319c02
SHA25677a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8
SHA512244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
26KB
MD528948521636f027a6e321d0ece85f68b
SHA14cc393871c2174328558347094d44cef430836d9
SHA25637d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197
SHA5122952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b
-
Filesize
10B
MD581570c50286369016cef7a9f904c4b04
SHA1b5758b23667cb35cad0adb23371b830fcee4f4e5
SHA256b882f41a5c84d248a75714eaf215a9e363a49361b6a14beedb921ee3dfdb46a1
SHA5120e6c479b0252e24635810b7d030cc9b5b17603ee20ccf62812446b8d15884521c6c7be65dfc0090bb1502e859fae27c2a63b3e58be714021f473a88407982162
-
\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
Filesize96KB
MD54f777a9f156035ab4670da6cdcbd651c
SHA178b6f97056e6d5674bbcb94f13c4bf5527319c02
SHA25677a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8
SHA512244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437