Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe
Resource
win10v2004-20240412-en
General
-
Target
6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe
-
Size
573KB
-
MD5
13422276d7810956f6445967f57b3d4f
-
SHA1
ad27cd941dc130c87147544dafb3fb889ce097c8
-
SHA256
6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06
-
SHA512
91b019fa08ae70098b00cb19662c9978be34825760be4f4aae4bf70517cd9e0c146a0870e3577faa85d8efd1290351cd0818e2da1856c3fb860c9415b22293c9
-
SSDEEP
6144:huJXYE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:C7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1276 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1196 Logo1_.exe 2640 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe -
Loads dropped DLL 1 IoCs
pid Process 1276 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\More Games\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe File created C:\Windows\Logo1_.exe 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe 1196 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1276 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 28 PID 1848 wrote to memory of 1276 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 28 PID 1848 wrote to memory of 1276 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 28 PID 1848 wrote to memory of 1276 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 28 PID 1848 wrote to memory of 1196 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 29 PID 1848 wrote to memory of 1196 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 29 PID 1848 wrote to memory of 1196 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 29 PID 1848 wrote to memory of 1196 1848 6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe 29 PID 1196 wrote to memory of 2920 1196 Logo1_.exe 30 PID 1196 wrote to memory of 2920 1196 Logo1_.exe 30 PID 1196 wrote to memory of 2920 1196 Logo1_.exe 30 PID 1196 wrote to memory of 2920 1196 Logo1_.exe 30 PID 2920 wrote to memory of 2576 2920 net.exe 33 PID 2920 wrote to memory of 2576 2920 net.exe 33 PID 2920 wrote to memory of 2576 2920 net.exe 33 PID 2920 wrote to memory of 2576 2920 net.exe 33 PID 1276 wrote to memory of 2640 1276 cmd.exe 34 PID 1276 wrote to memory of 2640 1276 cmd.exe 34 PID 1276 wrote to memory of 2640 1276 cmd.exe 34 PID 1276 wrote to memory of 2640 1276 cmd.exe 34 PID 1196 wrote to memory of 1368 1196 Logo1_.exe 21 PID 1196 wrote to memory of 1368 1196 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a18AF.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"4⤵
- Executes dropped EXE
PID:2640
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2576
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD55427c8355686e9236966d4dcd2119f7d
SHA1441677316f5b657a05982f73fce0c439e7155a44
SHA256678007290f0ed12852fcdeb88dd9cdb7b40913508d8cc9772cfcb40a7e217936
SHA51267cdc1309d3e076088b3d16875b92f2bd0f060576441319e325560eca7d7c5f0afd15165cc76f49887fff67c869c5c835925d81288ad2add23d0d89a5647f97b
-
Filesize
474KB
MD545ba25b4e6fe57152a1966bdea786d3c
SHA1b79b3a4f2d3b525688edf4b7818a400822834361
SHA256d309f5130994c60441620daef072bc849b8a4e8af881f25946ecbe8761448834
SHA5128ddb1e63c9454ae572f25d9353cafcffc238d5be3b6ddec87cefcf8280fcbaa3e7c59db2cff67a458c55bb0da9c07cee3c972f7ab18cee8dcbfcf3b5b1a5d699
-
Filesize
722B
MD55e2d837a3791cbf83f23f696a08c9436
SHA1d0e0765cf442a87a34fce50899d44e25a6f7d3de
SHA2560f005eb7560d89d59cb8d370d9f2eb0694573dbfd3dd080ff8d7804b58eed765
SHA51272a06f353219e280a525e9fb2c486cc766d2637ad435f97834ad13d7e9dd23fc34975674f465c1dd3cd38aae53bb906e99627dbcd4cf5c0795a8884da50440d1
-
C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
29KB
MD5243b2978a3e87c6a237767247bbbf6ef
SHA1b592a11def8ab37d926ab4bc5601aaf1fc852c2a
SHA256ea5e030c047d36a2bd930bd50153e3bf228e7644a3e30ce24bc9cb0f92f48a9c
SHA512f8a617e6c1b790984b8df091938966b68916033b596b0fad51e2c19e0f33ccead7fe35032d0b8db2747fa20f065b87b36226c15e7e46eef73686699f142d71f6
-
Filesize
9B
MD572b7e38c6ba037d117f32b55c07b1a9c
SHA135e2435e512e17ca2be885e17d75913f06b90361
SHA256e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6
SHA5122bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a