Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
General
-
Target
cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe
-
Size
67KB
-
MD5
5077127cd8e3f2ad3f4edc280324cf91
-
SHA1
7b7bb040200537e015b1abf761b989303e31813e
-
SHA256
cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1
-
SHA512
94ab89aa75c491bd1053c076c78081c58d2fed4f57f9293c476a9eb18346ed6ed96f74ffe4814d36b2b93e18efb68bf27e750b02765dab17e8150b2b08105d3c
-
SSDEEP
1536:hxDacx1aeg1vjrI9U/xvyyyZoEV0JuRUFyMOaHQ1l:hMf9kU0+k0JXXOeQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2016 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1732 Logo1_.exe 2580 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe -
Loads dropped DLL 2 IoCs
pid Process 2016 cmd.exe 2016 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Google\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\FreeCell\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\dtplugin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe 1732 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 628 wrote to memory of 2224 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 15 PID 628 wrote to memory of 2224 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 15 PID 628 wrote to memory of 2224 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 15 PID 628 wrote to memory of 2224 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 15 PID 2224 wrote to memory of 2540 2224 net.exe 16 PID 2224 wrote to memory of 2540 2224 net.exe 16 PID 2224 wrote to memory of 2540 2224 net.exe 16 PID 2224 wrote to memory of 2540 2224 net.exe 16 PID 628 wrote to memory of 2016 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 37 PID 628 wrote to memory of 2016 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 37 PID 628 wrote to memory of 2016 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 37 PID 628 wrote to memory of 2016 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 37 PID 628 wrote to memory of 1732 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 36 PID 628 wrote to memory of 1732 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 36 PID 628 wrote to memory of 1732 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 36 PID 628 wrote to memory of 1732 628 cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe 36 PID 1732 wrote to memory of 2656 1732 Logo1_.exe 31 PID 1732 wrote to memory of 2656 1732 Logo1_.exe 31 PID 1732 wrote to memory of 2656 1732 Logo1_.exe 31 PID 1732 wrote to memory of 2656 1732 Logo1_.exe 31 PID 2656 wrote to memory of 2608 2656 net.exe 33 PID 2656 wrote to memory of 2608 2656 net.exe 33 PID 2656 wrote to memory of 2608 2656 net.exe 33 PID 2656 wrote to memory of 2608 2656 net.exe 33 PID 2016 wrote to memory of 2580 2016 cmd.exe 32 PID 2016 wrote to memory of 2580 2016 cmd.exe 32 PID 2016 wrote to memory of 2580 2016 cmd.exe 32 PID 2016 wrote to memory of 2580 2016 cmd.exe 32 PID 1732 wrote to memory of 2880 1732 Logo1_.exe 40 PID 1732 wrote to memory of 2880 1732 Logo1_.exe 40 PID 1732 wrote to memory of 2880 1732 Logo1_.exe 40 PID 1732 wrote to memory of 2880 1732 Logo1_.exe 40 PID 2880 wrote to memory of 2492 2880 net.exe 38 PID 2880 wrote to memory of 2492 2880 net.exe 38 PID 2880 wrote to memory of 2492 2880 net.exe 38 PID 2880 wrote to memory of 2492 2880 net.exe 38 PID 1732 wrote to memory of 1384 1732 Logo1_.exe 7 PID 1732 wrote to memory of 1384 1732 Logo1_.exe 7
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe"C:\Users\Admin\AppData\Local\Temp\cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵PID:2540
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a15C2.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1384
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"2⤵PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe"C:\Users\Admin\AppData\Local\Temp\cdc4e9a97cfdb29e14ebee1564049b662945f3cde9d8ccb2e479d21c165ffdf1.exe"1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"1⤵PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5d3adc69a0af918de8ca779119dc3824e
SHA11acd37dbe349ee094f20adedeead47187d449876
SHA256331366057a460595eea4cd12de73bd9e2fcc6127487fc6a070b1d1c056700f9f
SHA512346c88bf50e019ff7ebe812584dedba2b1dd13ac02e58f75c0e6c3834daf9c87000bf4f1bba0d2075edfaa24413cc11decf9dcddb05dcc7d9c72294186f1e733
-
Filesize
478KB
MD544f2a0b82d8247e1cd5a12a40841f9a8
SHA1f451bd8ba9098bb674624169aa40f0371ba67924
SHA256056311169bf6ff9bf378a311dbd3c48697ccce39bedac8cb9ddb7da01384127d
SHA512bd5f7bf6b83c70bd03416a4944f62fdafbcb7907c3321432c831e189e9d4f95a52faefa575de57209fa5c1523ebed5fde8831f6230fc6f23400bbd33e772c219
-
Filesize
8B
MD5209b72362215bdaaf45b2d2388ee962c
SHA1872a46c03b4ff1322f5dd750c7ac0a07e5113ca0
SHA25656dc9a9a2aef97a2582545195a5ae52880339dff396cf5a749551379418aed62
SHA51245e9bfd535948c288f7342c28cc31fa63331dddc3b2f38afeb6cc1547f1301c46c97f9925905ee4d0ca46bb2d5f40181b913cfeaf9763ae6a38debdd24db7cc9