Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe
Resource
win10v2004-20240226-en
General
-
Target
31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe
-
Size
381KB
-
MD5
c4c8cb796091adbbae269b05094e7332
-
SHA1
7cbbc98f889ade6945bc46fcf904999e66c8f308
-
SHA256
31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc
-
SHA512
1ffcaa3cef4bde4734dc1ff454bbba78e07989e07f9a699dffc694f89d819632c736fd082212cf855813e0b0342e524494e581076fcbcd4b1182140c696605c7
-
SSDEEP
6144:MVfjmN+6x0Joevr9BIfamYnwA92lGh5qyM4mF5sAOj/dxCzHa3NrJQe:O7++A02evr/IfamWkCM4OSdxma3Nrj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2472 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2980 Logo1_.exe 2640 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe -
Loads dropped DLL 1 IoCs
pid Process 2472 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe File created C:\Windows\Logo1_.exe 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe 2980 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2472 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 28 PID 2276 wrote to memory of 2472 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 28 PID 2276 wrote to memory of 2472 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 28 PID 2276 wrote to memory of 2472 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 28 PID 2276 wrote to memory of 2980 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 29 PID 2276 wrote to memory of 2980 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 29 PID 2276 wrote to memory of 2980 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 29 PID 2276 wrote to memory of 2980 2276 31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe 29 PID 2980 wrote to memory of 2572 2980 Logo1_.exe 30 PID 2980 wrote to memory of 2572 2980 Logo1_.exe 30 PID 2980 wrote to memory of 2572 2980 Logo1_.exe 30 PID 2980 wrote to memory of 2572 2980 Logo1_.exe 30 PID 2572 wrote to memory of 2632 2572 net.exe 33 PID 2572 wrote to memory of 2632 2572 net.exe 33 PID 2572 wrote to memory of 2632 2572 net.exe 33 PID 2572 wrote to memory of 2632 2572 net.exe 33 PID 2472 wrote to memory of 2640 2472 cmd.exe 34 PID 2472 wrote to memory of 2640 2472 cmd.exe 34 PID 2472 wrote to memory of 2640 2472 cmd.exe 34 PID 2472 wrote to memory of 2640 2472 cmd.exe 34 PID 2980 wrote to memory of 1148 2980 Logo1_.exe 20 PID 2980 wrote to memory of 1148 2980 Logo1_.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe"C:\Users\Admin\AppData\Local\Temp\31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aC60.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe"C:\Users\Admin\AppData\Local\Temp\31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe"4⤵
- Executes dropped EXE
PID:2640
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2632
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5717bbf070b0486e85b4c31139c219c7e
SHA10e361c843f2a2586f6b80fcec5363f478ef9b251
SHA25625b83b39261bb702ed450e78d6d76c653cc1f6c12d70065be96a83df057a7156
SHA5122926f4012914e741b8653e3f9e2c7c4d2162b04ac97479709bd6126c5587755f8b71bb5b8d0df85580557c1aed475c5f4acf365c2f5e0026b4f448ecbd473c39
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
721B
MD56f53a954b08832e44fbd853c1cd2b40c
SHA1004e447ad78ffbdd8b93717d8b2940d8af45a993
SHA256fc4335cbeffc237cd233ad61575c166c2083d0fbe71a272ebc9c777cd6a52234
SHA512a161acf2ba485fbe64c9c756456b37011532125b8678ef25f97da66e7b3e77a19d7b5109ba78fa8f77d53a5f24919fd06232ca637347c5ef504214d3e6006f29
-
C:\Users\Admin\AppData\Local\Temp\31d3d7d119de686232e9d19128b2ff3d67e2259b131c11525b22787b197db9dc.exe.exe
Filesize354KB
MD5e552401ea07d0e12ca80e294a78819cd
SHA136d05c8c18cc9c073d6488a4cf63ba7be8e61c55
SHA256d8dfc83a5cf4d0567437ba971e3b712631c85666767c900f62695abca447f728
SHA512c75b4cda661b14e79dd20add36bbf8584b6bbc4e9068f7d613765bf5d633c50d18d71a1954be896b4244de17c784335b0241dcc368bd00877dc86d7eed8548d2
-
Filesize
26KB
MD5bbe25ec5fb983e881cda55b0a827d9b9
SHA1448be06c535598b29e10e7feec613612f0030121
SHA2560b9164da17c3f89558fac9e2a2f5362619ea58990822d6171ffa43eb8b579c7a
SHA5121fea6f1ee33645476fbf8e7cbf21dfb06b113aea208f238fa274f43d7a54af87a6966b0bed9ea10543613732656fec5535ac4e973d724d99f6016a47410757ef
-
Filesize
8B
MD5eb3fe7085aac4986a5db69d6c382011f
SHA119c0d93bf576dc3bcf232628428d6218f91767a0
SHA25641f6ad8112406e684ecf32a535c20fbac2db8d577e00b14197146b599a4b6ab2
SHA51226ed6484407c76b27987c2ed0e5ec2522ea6053de299c486841195690c536d72d0569fb291a9b9a91ce74fa22f4c37c43b491f4d0ff00afb8771bd36a7dcf508