Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0b7ab3127f73fc44af1af4362511e71.exe
Resource
win7-20240319-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0b7ab3127f73fc44af1af4362511e71.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
e0b7ab3127f73fc44af1af4362511e71.exe
-
Size
166KB
-
MD5
e0b7ab3127f73fc44af1af4362511e71
-
SHA1
ce8ecbb24762f4c03b79a8020ccce06dc25414e4
-
SHA256
47e3e5fbba12babd157f4fb1a8388088384f070847f5e86836898f52c8fc2afc
-
SHA512
4b74979c59a50935f036e1852b7f6fe48e8159d0a45db202f5a356ca306c3ddebfd02de868583602667aecefd0042f3621dd38d332f5dcf0281d9ea852dc99bc
-
SSDEEP
3072:ILe+aX3zvUzAMe5CZbJ/uKtGvF13q/POIekjNbf6JclSN2uAhRG9C+:3+aX3L2ARGFPR+kxmiWAI
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2952 Logo1_.exe 3052 e0b7ab3127f73fc44af1af4362511e71.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\skins\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Media Player\uk-UA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Multimedia Platform\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe e0b7ab3127f73fc44af1af4362511e71.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe e0b7ab3127f73fc44af1af4362511e71.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 644 e0b7ab3127f73fc44af1af4362511e71.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe 2952 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 644 wrote to memory of 1964 644 e0b7ab3127f73fc44af1af4362511e71.exe 89 PID 644 wrote to memory of 1964 644 e0b7ab3127f73fc44af1af4362511e71.exe 89 PID 644 wrote to memory of 1964 644 e0b7ab3127f73fc44af1af4362511e71.exe 89 PID 1964 wrote to memory of 4624 1964 net.exe 91 PID 1964 wrote to memory of 4624 1964 net.exe 91 PID 1964 wrote to memory of 4624 1964 net.exe 91 PID 644 wrote to memory of 2504 644 e0b7ab3127f73fc44af1af4362511e71.exe 92 PID 644 wrote to memory of 2504 644 e0b7ab3127f73fc44af1af4362511e71.exe 92 PID 644 wrote to memory of 2504 644 e0b7ab3127f73fc44af1af4362511e71.exe 92 PID 644 wrote to memory of 2952 644 e0b7ab3127f73fc44af1af4362511e71.exe 93 PID 644 wrote to memory of 2952 644 e0b7ab3127f73fc44af1af4362511e71.exe 93 PID 644 wrote to memory of 2952 644 e0b7ab3127f73fc44af1af4362511e71.exe 93 PID 2952 wrote to memory of 4752 2952 Logo1_.exe 94 PID 2952 wrote to memory of 4752 2952 Logo1_.exe 94 PID 2952 wrote to memory of 4752 2952 Logo1_.exe 94 PID 4752 wrote to memory of 1524 4752 net.exe 96 PID 4752 wrote to memory of 1524 4752 net.exe 96 PID 4752 wrote to memory of 1524 4752 net.exe 96 PID 2952 wrote to memory of 3864 2952 Logo1_.exe 100 PID 2952 wrote to memory of 3864 2952 Logo1_.exe 100 PID 2952 wrote to memory of 3864 2952 Logo1_.exe 100 PID 3864 wrote to memory of 668 3864 net.exe 102 PID 3864 wrote to memory of 668 3864 net.exe 102 PID 3864 wrote to memory of 668 3864 net.exe 102 PID 2952 wrote to memory of 3548 2952 Logo1_.exe 56 PID 2952 wrote to memory of 3548 2952 Logo1_.exe 56 PID 2504 wrote to memory of 3052 2504 cmd.exe 103 PID 2504 wrote to memory of 3052 2504 cmd.exe 103 PID 2504 wrote to memory of 3052 2504 cmd.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\e0b7ab3127f73fc44af1af4362511e71.exe"C:\Users\Admin\AppData\Local\Temp\e0b7ab3127f73fc44af1af4362511e71.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a466A.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\e0b7ab3127f73fc44af1af4362511e71.exe"C:\Users\Admin\AppData\Local\Temp\e0b7ab3127f73fc44af1af4362511e71.exe"4⤵
- Executes dropped EXE
PID:3052
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1524
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:668
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD57bf500941b5c6b7af0458bc6fd7649ff
SHA17f8188f459d1f94cfdcf13dfc3775fe73df97f6c
SHA256320fe62fe1b452c6562da3473118ee796e0f8af3ef53d4e5d9ace935015530a9
SHA5125f62fee80c99ce2d4f5cf752db2bd73b1b5a2495cf85fb6c0ae703e3ce8a5860dd7ef27792c7e8a728920f39bd8b53d71b968160e070dd7603b09229e9b004b8
-
Filesize
530B
MD50abf569cee883d52333481bc9f88f27f
SHA16d749e890aa08d0ddcd6cbb22374c12f49f11139
SHA256dc2e73c9a6ed9aee6f3a6f2c0e0dc619cff72d4210bc53384f2b584108852af6
SHA512079e9406097873216ede6e644fc08269d27ae945ffc0df92544aab0b7622969f3ece44be9eb1c6842ac047faa6dbc7a329d7c8f1037f4c345bb7795b28a558e6
-
Filesize
133KB
MD5199f5eceb89ea8d47752c7d93282aaca
SHA189bc3c28445228994d2fe2927ed7a58e90d88f6a
SHA256857fdaa2bd8d84efe9ebeda9b8577c30da8cff4e2f7db80b06a07c89c22e6da7
SHA512ae21d78626787f6c07e20473b157548e705d39c05e2167647506c81ca3857c1fda53e959956dec30d61eade5a26b09cad03b2ffa3615ce982fe1412c1d416949
-
Filesize
33KB
MD5882fb7fca0106ebde62148a324a99e18
SHA122c2ed58751ee35ca2b96342c5c42894501e3ec5
SHA256d36e1c820e2e2390f17125140b2d19e092b2a75ba12d7816ec4acec15c3a2dcf
SHA512e92448eb03243d31f04daff133b1db922bfe1ee9a1721bb5afd8c67a426617865e51daa7378ae883598084bf286472cce5288e9ed3210169a01497c1c0064c27
-
Filesize
9B
MD5f290d5b34b77b963189d043630703b29
SHA1f3dbfaa00f863d39575c7adf50bddbf02900d6b3
SHA2564c76a275d94e486451f7797077242c8636df44e88643a2208b0a876c4ad5433b
SHA512b4ffa173d60592b9219d188bd7eb4d96e0543e4c5350b903d96e0afea437f71753a520ac4397df2a39df8b84a9230f51c959995f8e436bcac4ff3567e9b35ef9