Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18/02/2024, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe
Resource
win10v2004-20231215-en
General
-
Target
a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe
-
Size
250KB
-
MD5
e2213852fc8a351313125454150660fd
-
SHA1
3ccc1537d29fd2f70b45cb658a2b5409da55273a
-
SHA256
a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5
-
SHA512
50c6cc3557a3aa0cbcbe45093669f29efa527ecba8879253a2b8eb0c369a7795de6b021b7e222f7e03b6d1003d5f30fb4838200743654d08a2953d333aeda373
-
SSDEEP
3072:UftffjmNR1KwhdmWWKp9pSVLCDJGhyBw948qNYpWdunn4rSpYKOQwq:sVfjmN/Kwhdt9t8LLyBw948kwn4WpgN
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2728 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2600 Logo1_.exe 2540 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe -
Loads dropped DLL 2 IoCs
pid Process 2728 cmd.exe 2728 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe File created C:\Windows\Logo1_.exe a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe 2600 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2728 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 28 PID 1268 wrote to memory of 2728 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 28 PID 1268 wrote to memory of 2728 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 28 PID 1268 wrote to memory of 2728 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 28 PID 1268 wrote to memory of 2600 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 29 PID 1268 wrote to memory of 2600 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 29 PID 1268 wrote to memory of 2600 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 29 PID 1268 wrote to memory of 2600 1268 a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe 29 PID 2600 wrote to memory of 2620 2600 Logo1_.exe 31 PID 2600 wrote to memory of 2620 2600 Logo1_.exe 31 PID 2600 wrote to memory of 2620 2600 Logo1_.exe 31 PID 2600 wrote to memory of 2620 2600 Logo1_.exe 31 PID 2728 wrote to memory of 2540 2728 cmd.exe 33 PID 2728 wrote to memory of 2540 2728 cmd.exe 33 PID 2728 wrote to memory of 2540 2728 cmd.exe 33 PID 2728 wrote to memory of 2540 2728 cmd.exe 33 PID 2620 wrote to memory of 2916 2620 net.exe 34 PID 2620 wrote to memory of 2916 2620 net.exe 34 PID 2620 wrote to memory of 2916 2620 net.exe 34 PID 2620 wrote to memory of 2916 2620 net.exe 34 PID 2600 wrote to memory of 1216 2600 Logo1_.exe 22 PID 2600 wrote to memory of 1216 2600 Logo1_.exe 22
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aEEF.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"4⤵
- Executes dropped EXE
PID:2540
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2916
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD599c8f62c614e57d982794cb60ed34dd3
SHA1ae21b94005dffc23085bfa84938011703cf62341
SHA2566c8a8a5c788ca6330693c0be9a11a630a7cccfab9a1c2d8270ed9624eb9b4cd3
SHA5128db3d0754d569b05d9eeba2e83630f0b94d87b809d9918294b8b8920f4ddc4591b08fe3759dad966216174cc308fb7850d84e1b5e6ac17415c6df70b52f871a2
-
Filesize
471KB
MD599ea9b604a7a734d3087fa6159684c42
SHA1709fa1068ad4d560fe03e05b68056f1b0bedbfc8
SHA2563f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c
SHA5127af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb
-
Filesize
721B
MD5e837f7e7894d289c935fa3c774366574
SHA13dae71367115fea88c6a8b1302123561f7780143
SHA256cf00e72a816ed7d5197a8b87132c0b63481b4dbbccd5a4ab164b9985f48bd195
SHA512ca28fafe4df4e66f93e739560f8a57a31fb1cd4fc2f87ea9c005841d8c0f8431290758a9c926e93b0181e4b4116a9b2df2a5be1568f80e469e99da5803d95c99
-
C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe.exe
Filesize224KB
MD57c0ffab1bad3ca02411a7044b11577fa
SHA170c83e69d16ce603eef0150670e2d412b5891433
SHA25652f7c5e40477df6ca3e7a82eab1ae2cc570f7891daeb124649970a1e508d61f0
SHA5120cf2cc7b522b7b12224b79a05a622b13607d5a0d6afee22b92129a68896c20cbd80c06588ece95bf55a1054b05454ac3a989b109c6c73e832a5c3c2b5c4c8e2e
-
Filesize
26KB
MD5d2a8721a9ab0785cc63008221bed7014
SHA1b3b61e2dfe21e53c998bae3626cd51babf43ef2c
SHA2566a54a916b9c41f2aae07186bd293005cd3af983bd85039d4a03b13acca905ccb
SHA512b6f049f934951051bfc226a43ce3e957d22d44ad15e057b009e76d07f9f00a63c1d4411c77362db7ace866c0d99e46ee9fb56ae810683d783436b4e972c744e0
-
Filesize
9B
MD59eb559d99f8f10c8af6f6d1c5624b40d
SHA16bd3c9c30ab64be20819ce184dfeb093f664ec68
SHA25660748c106f2d8f06a3c713e00fab9fc8fd7bd9938dc4f8ee91317dcaaf1bc881
SHA5127f7a165bbddce5030f223b60a6f968a30458f7be999e6374ae52d4723dbb24ff571a7db89410ce516b17f535b278da436ed35710dab7c8ec1c18b12278ad1e62