Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
Resource
win7-20231129-en
General
-
Target
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
-
Size
169KB
-
MD5
d87d6facaf717caddf9e05d153ba3c92
-
SHA1
52a6c747fd184bb09b2a76e534555173d3127ce9
-
SHA256
4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8
-
SHA512
e5bcd1335967f0f6d2454c24619d1c8119a17b584340829925cc2ea5f239c1c0b8741729b422e23fa1ab49e4952911ab56786f7743a41d063f3d063ec7edc6ed
-
SSDEEP
3072:8GYe+azbRPrlr9RXFcQekqnwLD9m0WjfuRRfEdj4E3f90bC:td+azbRZvSQek9if1Vv+W
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1696 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 544 Logo1_.exe 2844 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe -
Loads dropped DLL 1 IoCs
pid Process 1696 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File created C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe File created C:\Windows\Logo1_.exe 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe 544 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 624 wrote to memory of 2992 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 28 PID 624 wrote to memory of 2992 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 28 PID 624 wrote to memory of 2992 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 28 PID 624 wrote to memory of 2992 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 28 PID 2992 wrote to memory of 1196 2992 net.exe 30 PID 2992 wrote to memory of 1196 2992 net.exe 30 PID 2992 wrote to memory of 1196 2992 net.exe 30 PID 2992 wrote to memory of 1196 2992 net.exe 30 PID 624 wrote to memory of 1696 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 31 PID 624 wrote to memory of 1696 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 31 PID 624 wrote to memory of 1696 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 31 PID 624 wrote to memory of 1696 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 31 PID 624 wrote to memory of 544 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 33 PID 624 wrote to memory of 544 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 33 PID 624 wrote to memory of 544 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 33 PID 624 wrote to memory of 544 624 4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe 33 PID 544 wrote to memory of 2592 544 Logo1_.exe 34 PID 544 wrote to memory of 2592 544 Logo1_.exe 34 PID 544 wrote to memory of 2592 544 Logo1_.exe 34 PID 544 wrote to memory of 2592 544 Logo1_.exe 34 PID 2592 wrote to memory of 2676 2592 net.exe 36 PID 2592 wrote to memory of 2676 2592 net.exe 36 PID 2592 wrote to memory of 2676 2592 net.exe 36 PID 2592 wrote to memory of 2676 2592 net.exe 36 PID 1696 wrote to memory of 2844 1696 cmd.exe 37 PID 1696 wrote to memory of 2844 1696 cmd.exe 37 PID 1696 wrote to memory of 2844 1696 cmd.exe 37 PID 1696 wrote to memory of 2844 1696 cmd.exe 37 PID 544 wrote to memory of 2072 544 Logo1_.exe 38 PID 544 wrote to memory of 2072 544 Logo1_.exe 38 PID 544 wrote to memory of 2072 544 Logo1_.exe 38 PID 544 wrote to memory of 2072 544 Logo1_.exe 38 PID 2072 wrote to memory of 2788 2072 net.exe 40 PID 2072 wrote to memory of 2788 2072 net.exe 40 PID 2072 wrote to memory of 2788 2072 net.exe 40 PID 2072 wrote to memory of 2788 2072 net.exe 40 PID 544 wrote to memory of 1360 544 Logo1_.exe 21 PID 544 wrote to memory of 1360 544 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a149A.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"4⤵
- Executes dropped EXE
PID:2844
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2676
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2788
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5ab6e14fd3b3b82a74d70dd03d0a8e116
SHA1e8263c09ed7968ab04e1459ad46041ccdd9ff5e9
SHA25603dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
SHA512851e9288ba102d5eabd34d887b70a883307bce31ccb4c7eeaf2b3010cb6bb9435a9c0261bfdafb4a0bf4046b6bc7928cbfb62599269a9c197ec2f83efaf258e8
-
Filesize
722B
MD5ac752ac08790c9821335493d402cec69
SHA11b2396d690dd2bf5ac7d43b7e8704b0ce0515029
SHA2567bff3378f5e233141d230ce8a60ec8e4b67cde54b107299b1c547916ac3ea034
SHA5127e0976b69beacca5559eb8004e7189879ca5f8e310d2730f4cdeaa01fbb2ef9127f61b1d7e1490db9a04178abf04bcb7e4847792679970c477f977ce92688ec9
-
C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe.exe
Filesize129KB
MD511111df26aba5a177fbd3ff2821a9e5d
SHA1dba82329673e02dd99adbeb2d20538d10b6f484a
SHA25625e0e882cca2fc89942924ae208abf9059fe3f8bd87a16f788f8aad1f61521df
SHA5124d814017ce21b06208b5cd6814d40e801283a41216ea27986a88af50d2d61d23e9c54c0aafe6a8c509a94d156c59fb3dc8f46b902bcbc5acd185a712d31b2034
-
Filesize
39KB
MD5bc43e3c481e7fbe3ee697f9017cf4c1b
SHA16a76534a3a4bd72437b06bdccf1475846d7a308d
SHA256c33f277a3cea2a938fc05fda7bf9b9a0ae89474eaacf6b0b6223e07eb4ec3b6a
SHA512e5c2f3485b7573a6638f6d5ea2907371efc68b35655739e8e0c8f841de9c2d302b246eacb9627912cee5dd7ab0a9f7f652e73eb7d1925ddde20bb92e29310ce1
-
Filesize
9B
MD5f29b71f66ac42a28a8d1e12a13d61861
SHA1bd61fbc8b6eed4cae3fa29d7b950784258be10cd
SHA2569a5e4ff44f8f5bb21798074ea03e493911b59680e37191522562dece826da1cf
SHA51290c31cda60a9a63e3fa78e99f1104d1a9c9f811e11b62f75063b6007ae284c8c233b5d1235defab7ae0deec3b7892c85af9319219405c44d16fa29a3215f50e0