Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
Resource
win10v2004-20240412-en
General
-
Target
b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
-
Size
49KB
-
MD5
5233018ae9929103e578e6abbe0baee6
-
SHA1
588aec4baaf13e11293f172a15bc49f8a957c461
-
SHA256
b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864
-
SHA512
1be91ee1775dd674a8c3295c87f10b46d28893219d2e68363b91ee9af486a912b376cdc2ab66d042011e324aaf6cfcdaf9324284f2d5cacb673e361aa8bb3abe
-
SSDEEP
768:pr16GVRu1yK9fMnJG2V9dHS8bnV9P85GB2FlFfNDG7qHUf2h:pB3SHuJV9NHV9kFfO2Uf
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2064 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2004 Logo1_.exe 2572 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe -
Loads dropped DLL 1 IoCs
pid Process 2064 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe File created C:\Windows\Logo1_.exe b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe 2004 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2064 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 28 PID 1720 wrote to memory of 2064 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 28 PID 1720 wrote to memory of 2064 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 28 PID 1720 wrote to memory of 2064 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 28 PID 1720 wrote to memory of 2004 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 29 PID 1720 wrote to memory of 2004 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 29 PID 1720 wrote to memory of 2004 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 29 PID 1720 wrote to memory of 2004 1720 b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe 29 PID 2004 wrote to memory of 1732 2004 Logo1_.exe 31 PID 2004 wrote to memory of 1732 2004 Logo1_.exe 31 PID 2004 wrote to memory of 1732 2004 Logo1_.exe 31 PID 2004 wrote to memory of 1732 2004 Logo1_.exe 31 PID 1732 wrote to memory of 2660 1732 net.exe 33 PID 1732 wrote to memory of 2660 1732 net.exe 33 PID 1732 wrote to memory of 2660 1732 net.exe 33 PID 1732 wrote to memory of 2660 1732 net.exe 33 PID 2064 wrote to memory of 2572 2064 cmd.exe 34 PID 2064 wrote to memory of 2572 2064 cmd.exe 34 PID 2064 wrote to memory of 2572 2064 cmd.exe 34 PID 2064 wrote to memory of 2572 2064 cmd.exe 34 PID 2004 wrote to memory of 1256 2004 Logo1_.exe 21 PID 2004 wrote to memory of 1256 2004 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1758.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"4⤵
- Executes dropped EXE
PID:2572
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2660
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD531b58266e648b3ce129dbb398da4eb8d
SHA13fef7bf9dc3e9a9cbeb336f961122328e98728b0
SHA256f7ff76094663c11af4a4849043227d365924ab84b94b2bbcb533a87f20ccff58
SHA512f9dd0e0cebdeb060f238d071672c2f6aa808eaebce5c8ff016c90ca6d74b35467e86596e7fba8d2b2b37b8f90a650cad74530e024d1b6ff717a308393ab1e334
-
Filesize
474KB
MD56eabc463f8025a7e6e65f38cba22f126
SHA13e430ee5ec01c5509ed750b88d3473e7990dfe95
SHA256cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7
SHA512c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab
-
Filesize
722B
MD5422863654a9f636d5aea2b42952176ac
SHA10c3d8ea293ec3bc4ff0afa52dbc414cefce662ee
SHA256c46be7d66b1e85404b9cf6e698174e578265906f6adc2212fd478bce9cd0cf19
SHA512b7ed503f983afa48d51034939889769b959a9ea0b79d42c5af6adde3f302dc11b47150d93c29fddff2f0840640cbfea9b7f12c67c2e93d757f2475239ef943e7
-
C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe.exe
Filesize20KB
MD5041c541459d66173349737675707f8e8
SHA1675368be6d2585d97c58d904981037a4dd255af7
SHA2563e7712361e0ae26920b3b6caa299ef06a62fcc86301ec97c44df4981b3f2a446
SHA512c876e48e386602fd7f7353a7e0d7126ff2b890ebce04ffe751cf898509198ae8264c448b02894309d24e4f1e5315aae2a08402583cab838439af501bcad5aead
-
Filesize
29KB
MD5bc2a08f1fe0430eb261fa12807b391db
SHA1cfc8edda8d2a0eb6677468da30013b8c54a7a37c
SHA2567e2c164ef33df9f9c8d4493d7ba3ddffeb8d6a9a6363a76334472f52feb3f5bc
SHA51236419d572cc6e7f08c401dde59233bb4d50939c1471147572f11f1a4896eeb5a89228a945eb43d94fe0a6c44775a16c3b2f1c49691275d814f86105a1a346a49
-
Filesize
9B
MD55e45e0c42537212b4bfef35112ec91ba
SHA110c59c091fd35facc82bbc96938f118ce5a60546
SHA2569f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5
SHA512ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb