Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
Resource
win7-20231215-en
General
-
Target
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
-
Size
93KB
-
MD5
97517e1998bd7e881101a01efe0b4c68
-
SHA1
79b7b6159779aa9d4e09e55d08e5bbefbceac788
-
SHA256
a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3
-
SHA512
7d0ddb4e6bbaf2aac5d8de86c2c269ffa5effd4cdcc2b8ce49f48ed2182413a90fa62205daf6815064e52ca6d5f2758719ea6783e0cd9ba555594ad8b84d1634
-
SSDEEP
1536:cAsxN92ppTSahtA3AWHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:cfNIv7MwWhAWJGSCTBf12Z9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2764 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2164 Logo1_.exe 2724 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe -
Loads dropped DLL 2 IoCs
pid Process 2764 cmd.exe 2764 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe File created C:\Windows\Logo1_.exe a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe 2164 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3068 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 28 PID 3048 wrote to memory of 3068 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 28 PID 3048 wrote to memory of 3068 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 28 PID 3048 wrote to memory of 3068 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 28 PID 3068 wrote to memory of 2140 3068 net.exe 30 PID 3068 wrote to memory of 2140 3068 net.exe 30 PID 3068 wrote to memory of 2140 3068 net.exe 30 PID 3068 wrote to memory of 2140 3068 net.exe 30 PID 3048 wrote to memory of 2764 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 31 PID 3048 wrote to memory of 2764 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 31 PID 3048 wrote to memory of 2764 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 31 PID 3048 wrote to memory of 2764 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 31 PID 3048 wrote to memory of 2164 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 33 PID 3048 wrote to memory of 2164 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 33 PID 3048 wrote to memory of 2164 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 33 PID 3048 wrote to memory of 2164 3048 a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe 33 PID 2164 wrote to memory of 2732 2164 Logo1_.exe 34 PID 2164 wrote to memory of 2732 2164 Logo1_.exe 34 PID 2164 wrote to memory of 2732 2164 Logo1_.exe 34 PID 2164 wrote to memory of 2732 2164 Logo1_.exe 34 PID 2732 wrote to memory of 2856 2732 net.exe 36 PID 2732 wrote to memory of 2856 2732 net.exe 36 PID 2732 wrote to memory of 2856 2732 net.exe 36 PID 2732 wrote to memory of 2856 2732 net.exe 36 PID 2764 wrote to memory of 2724 2764 cmd.exe 37 PID 2764 wrote to memory of 2724 2764 cmd.exe 37 PID 2764 wrote to memory of 2724 2764 cmd.exe 37 PID 2764 wrote to memory of 2724 2764 cmd.exe 37 PID 2164 wrote to memory of 2584 2164 Logo1_.exe 38 PID 2164 wrote to memory of 2584 2164 Logo1_.exe 38 PID 2164 wrote to memory of 2584 2164 Logo1_.exe 38 PID 2164 wrote to memory of 2584 2164 Logo1_.exe 38 PID 2584 wrote to memory of 2736 2584 net.exe 40 PID 2584 wrote to memory of 2736 2584 net.exe 40 PID 2584 wrote to memory of 2736 2584 net.exe 40 PID 2584 wrote to memory of 2736 2584 net.exe 40 PID 2164 wrote to memory of 1272 2164 Logo1_.exe 21 PID 2164 wrote to memory of 1272 2164 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aA248.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"4⤵
- Executes dropped EXE
PID:2724
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2856
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2736
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5003f5729d264f6604effd8c07b7eb1a5
SHA1fd8b89c487f048985fa703ed68367532a406eec7
SHA2566e2d8b0c6e9be5fdeac0a81dc0820691500643aec80061e674981136bbabef9a
SHA51260b408dcb586d9a3a1553697fba435ac15c8a3780ae05c792db9c4baea0b9479c95daf79e35b1cb7629908a25ef9fbeb6c50249d16b1641e6cab5e2b190f1e87
-
Filesize
478KB
MD585bfd80e5e2a61689d1273c6efa51ccc
SHA18ae8a160124cc56983f24a933fbecdac08da435a
SHA256892cf1575e0cc60639951f9a5a37323f3ca7d06f335e8a39635c3b858596ea3c
SHA51296dd851f4d17a65aa6dfddfdc134a46d30b0417451b4c4b31092b66056cae59302d49b706294547e5766e347dc368ff4bd176d90376c5e2ad5c7a52aa8718a79
-
Filesize
722B
MD528316969f0feda37fd55b312eb2bc938
SHA1ea00ab0378380fa580e818d855c18d74846d97ce
SHA2567986a745d887fa0e023c0f13fa91adc98a4ff15aa42de857133e40c93ea45db8
SHA5124eacbd3c6c5fcd32afc9153e615a799c5938daab5e3f6702c00b4a30205829e0654a1c7cf65e32f908b63f9b069f7fa511191b7779fdea115e3d64c64cf8e974
-
C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe.exe
Filesize60KB
MD5ed0fde686788caec4f2cb1ec9c31680c
SHA181ae63b87eaa9fa5637835d2122c50953ae19d34
SHA256e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c
SHA512d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b
-
Filesize
33KB
MD574de944429af39f54ac31888ee07b892
SHA17c05f329379c5a396dbdf1e3857f59734eeaaf07
SHA25622a484df9625b0a17e2e7b65945360f0b031ec1bea68fb96d3553d07ab354f52
SHA512d4a8d643b207e1742071a11b05b3044c0750849f767ecbecb5e957d1df1bc95a312a0a595c7c34cc8a09523ef25deac47fddb4801735bcff6087879ef8d10fd7
-
Filesize
9B
MD562b5f4cbf35e0811170865d2c1b514b0
SHA1eb9ab8cea4d5052efe5126141140269f2fc29e7b
SHA2560c2b516efab7a741c31502cb6f7828de32cd4feb088b683d651225489f183bb3
SHA5124632536c26324e72b20e87d53546ea1d012bc1f3457ce5d8e1b33dd3eebc41ad5e4a3d3f6a3a542d7ce103f95ca5a5a1973c6c036980f1e8860c6c5d93c5696f