Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe
Resource
win10v2004-20230915-en
General
-
Target
182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe
-
Size
50KB
-
MD5
04b91c8721fd1d2ae1d20328d0787628
-
SHA1
a29a19c768ed04890c3394b179b063e0c8193e1e
-
SHA256
182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee
-
SHA512
7cf1872a0c5b17de367ab37fe4be0523f69492ac7616639d492a0e84fc925a00ed153d5d1f12428cde9d7bc57ad7864a18c42568271a6eb8a545a71487e25bb7
-
SSDEEP
768:1Hcp1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoLjdzbXjQLiaeB949rwXkAwQ6Ufn:YfgLdQAQfcfymN/ZXkWS9rwXkjUfn
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1280 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2320 Logo1_.exe 2532 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe -
Loads dropped DLL 1 IoCs
pid Process 1280 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\Templates\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe File created C:\Windows\Logo1_.exe 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe 2320 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1280 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 28 PID 1768 wrote to memory of 1280 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 28 PID 1768 wrote to memory of 1280 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 28 PID 1768 wrote to memory of 1280 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 28 PID 1768 wrote to memory of 2320 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 30 PID 1768 wrote to memory of 2320 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 30 PID 1768 wrote to memory of 2320 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 30 PID 1768 wrote to memory of 2320 1768 182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe 30 PID 2320 wrote to memory of 1152 2320 Logo1_.exe 31 PID 2320 wrote to memory of 1152 2320 Logo1_.exe 31 PID 2320 wrote to memory of 1152 2320 Logo1_.exe 31 PID 2320 wrote to memory of 1152 2320 Logo1_.exe 31 PID 1152 wrote to memory of 2784 1152 net.exe 33 PID 1152 wrote to memory of 2784 1152 net.exe 33 PID 1152 wrote to memory of 2784 1152 net.exe 33 PID 1152 wrote to memory of 2784 1152 net.exe 33 PID 1280 wrote to memory of 2532 1280 cmd.exe 34 PID 1280 wrote to memory of 2532 1280 cmd.exe 34 PID 1280 wrote to memory of 2532 1280 cmd.exe 34 PID 1280 wrote to memory of 2532 1280 cmd.exe 34 PID 2320 wrote to memory of 1216 2320 Logo1_.exe 22 PID 2320 wrote to memory of 1216 2320 Logo1_.exe 22
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe"C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a470E.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe"C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe"4⤵
- Executes dropped EXE
PID:2532
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2784
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5a3462a9812db1f60bc3eb3c2271e3c58
SHA1bfca9d49db3e4d9f8012b3430d4ebcfc0871fb35
SHA256cea07236ff5f010022f811bdfb17185ec00e08ca1f3338d319d7691f7676ef8d
SHA51262af2a036cb5a2faee2ff1c920a3442d3edec6ca4d2060f1df8d5a7677ebee08584b655a25fc188f971167c34dc03b1b3b4ec10928731cf766fe45ca6346876e
-
Filesize
722B
MD5a3462a9812db1f60bc3eb3c2271e3c58
SHA1bfca9d49db3e4d9f8012b3430d4ebcfc0871fb35
SHA256cea07236ff5f010022f811bdfb17185ec00e08ca1f3338d319d7691f7676ef8d
SHA51262af2a036cb5a2faee2ff1c920a3442d3edec6ca4d2060f1df8d5a7677ebee08584b655a25fc188f971167c34dc03b1b3b4ec10928731cf766fe45ca6346876e
-
C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe
Filesize23KB
MD5a5c496552546b7e79d6228a3a419bf5d
SHA1b29303a2d03d483baa2d5735df359c00aa9aed60
SHA2562d0b45fa608dd8336722d85be930bb0d271fc407230a6f5082fdb3b058f67119
SHA512c5d4973387ef18bfaaaf9ccf47fd0cbc485940fb77c59a4212bcf33c5cfc6b969d13bd34c3b7f5199925a7e40b19b4a3ae19cff5559c057fa106414c83775713
-
C:\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe.exe
Filesize23KB
MD5a5c496552546b7e79d6228a3a419bf5d
SHA1b29303a2d03d483baa2d5735df359c00aa9aed60
SHA2562d0b45fa608dd8336722d85be930bb0d271fc407230a6f5082fdb3b058f67119
SHA512c5d4973387ef18bfaaaf9ccf47fd0cbc485940fb77c59a4212bcf33c5cfc6b969d13bd34c3b7f5199925a7e40b19b4a3ae19cff5559c057fa106414c83775713
-
Filesize
26KB
MD5fdd504678a404fbffc560cd95a4363ff
SHA10e8a87142acaeadfe96f00ea117c05758b0514cc
SHA2564b396f3b3d76cd75e64a47eb652ab93d6239a197fd9b32c66619d6a8ffbdc2da
SHA512c6e5b506c5988072cbee535f18c89fec46fad599adff83a13ecb819bc157391a527eb5336c9c03392174a6ab345b699602fe9ecb0139a2a10a053f557ccc769f
-
Filesize
26KB
MD5fdd504678a404fbffc560cd95a4363ff
SHA10e8a87142acaeadfe96f00ea117c05758b0514cc
SHA2564b396f3b3d76cd75e64a47eb652ab93d6239a197fd9b32c66619d6a8ffbdc2da
SHA512c6e5b506c5988072cbee535f18c89fec46fad599adff83a13ecb819bc157391a527eb5336c9c03392174a6ab345b699602fe9ecb0139a2a10a053f557ccc769f
-
Filesize
26KB
MD5fdd504678a404fbffc560cd95a4363ff
SHA10e8a87142acaeadfe96f00ea117c05758b0514cc
SHA2564b396f3b3d76cd75e64a47eb652ab93d6239a197fd9b32c66619d6a8ffbdc2da
SHA512c6e5b506c5988072cbee535f18c89fec46fad599adff83a13ecb819bc157391a527eb5336c9c03392174a6ab345b699602fe9ecb0139a2a10a053f557ccc769f
-
Filesize
26KB
MD5fdd504678a404fbffc560cd95a4363ff
SHA10e8a87142acaeadfe96f00ea117c05758b0514cc
SHA2564b396f3b3d76cd75e64a47eb652ab93d6239a197fd9b32c66619d6a8ffbdc2da
SHA512c6e5b506c5988072cbee535f18c89fec46fad599adff83a13ecb819bc157391a527eb5336c9c03392174a6ab345b699602fe9ecb0139a2a10a053f557ccc769f
-
Filesize
10B
MD5743754b59d55d26c081d8f839a3662c8
SHA18e88e3bda53f58b9122f6f9c9a5f23f80e7be6c7
SHA256bbb0f1aae4572c821fac1d6b7890df67d9f4a7576af30e70925192dded063e8b
SHA5121e8d9e5e1651bd2aaef969713d949cc4ddab58c53d0be31392d660aedeb621a0f968196e4938d2ba75e40ebdb7557cee23bf5587877268cb087fdd09a8abba1b
-
\Users\Admin\AppData\Local\Temp\182f83b9d943d4c7a5a80cc457035405270e23644616baf0def200995446c3ee.exe
Filesize23KB
MD5a5c496552546b7e79d6228a3a419bf5d
SHA1b29303a2d03d483baa2d5735df359c00aa9aed60
SHA2562d0b45fa608dd8336722d85be930bb0d271fc407230a6f5082fdb3b058f67119
SHA512c5d4973387ef18bfaaaf9ccf47fd0cbc485940fb77c59a4212bcf33c5cfc6b969d13bd34c3b7f5199925a7e40b19b4a3ae19cff5559c057fa106414c83775713