Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe
Resource
win10v2004-20240226-en
General
-
Target
0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe
-
Size
364KB
-
MD5
559446f51a781e5ed2deddecce8bdd2f
-
SHA1
2e666db03cd56a94615ee44831bf010a0f01ac9f
-
SHA256
0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165
-
SHA512
ffb41c23af3dc8692d5ca30a7d85b6f7e3b181c7448fb493e6567c4f9eccc63836d0241b8b5729b9847ac5757f4c11ccacf16055a6a56d6b8b80a9a05051cd81
-
SSDEEP
6144:mUuJPzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:wU66b5zhVymA/XSRh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2972 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2132 Logo1_.exe 2592 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe -
Loads dropped DLL 1 IoCs
pid Process 2972 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe Logo1_.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1036\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe 2132 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2972 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 28 PID 1844 wrote to memory of 2972 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 28 PID 1844 wrote to memory of 2972 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 28 PID 1844 wrote to memory of 2972 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 28 PID 1844 wrote to memory of 2132 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 29 PID 1844 wrote to memory of 2132 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 29 PID 1844 wrote to memory of 2132 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 29 PID 1844 wrote to memory of 2132 1844 0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe 29 PID 2972 wrote to memory of 2592 2972 cmd.exe 32 PID 2972 wrote to memory of 2592 2972 cmd.exe 32 PID 2972 wrote to memory of 2592 2972 cmd.exe 32 PID 2972 wrote to memory of 2592 2972 cmd.exe 32 PID 2132 wrote to memory of 2672 2132 Logo1_.exe 31 PID 2132 wrote to memory of 2672 2132 Logo1_.exe 31 PID 2132 wrote to memory of 2672 2132 Logo1_.exe 31 PID 2132 wrote to memory of 2672 2132 Logo1_.exe 31 PID 2672 wrote to memory of 2512 2672 net.exe 34 PID 2672 wrote to memory of 2512 2672 net.exe 34 PID 2672 wrote to memory of 2512 2672 net.exe 34 PID 2672 wrote to memory of 2512 2672 net.exe 34 PID 2132 wrote to memory of 1104 2132 Logo1_.exe 20 PID 2132 wrote to memory of 1104 2132 Logo1_.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe"C:\Users\Admin\AppData\Local\Temp\0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aDE6.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe"C:\Users\Admin\AppData\Local\Temp\0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe"4⤵
- Executes dropped EXE
PID:2592
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2512
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD58b9d754f6a062a360f1eca184e4360bd
SHA129dff755cbcee35a9daf3b7a548b569c1126b616
SHA256e17ac11d2dd6a2fa4d9adb98701499f6a0c7f748830c98f6d780cdf1a0af6789
SHA5122722e3e400b4b27ef20c7a96b64d98fdc729a48b3f199ad87dbf3cef5912b58c6604a2b69f737ef211093b9c0ec99bbc7d5885a07f61a619d4492b5ffbe198ef
-
Filesize
474KB
MD5e96712cc2991fab37a21ceeeee83b1f6
SHA1e7894f4029baf5faa81584bab7d20acb0feadf5f
SHA256fc5ecf67ef00e72d234c1b58be4d807a7fa2603cf66085204bacabb796275153
SHA512fd8ba411e0083b3120431f23f272daf3923c96c96a15f7f861565b4de85fce7bf5aafd42d15cf45c559b8e7192513a31b9167ec7c5b6f52823bf3dc20701a06e
-
Filesize
721B
MD58e562745ff7d4b305e97fe8ac95ad3aa
SHA11ca8d676c42809325c2153f0834b1676b7c219bc
SHA2560ce3480a0ef3323d10813685b6c808879a0eb0d698b84969e81c8c6b7d4fcd27
SHA51285b7bb7f9f64fae56de0c9bb91b3f6c883f5cb75881a3d5486481e395bff5b89be546a7dee4fd3c295091f7f01648cb508c6ab5da5e5ca77ade9be6b005db490
-
C:\Users\Admin\AppData\Local\Temp\0735cfd67e0cb1dedbfa02b1883b741989019ee38b4844ed6bf57ae83e566165.exe.exe
Filesize335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
Filesize
29KB
MD524743dc5d84b6ed4f72fe9d489cdc87d
SHA10617cf95dbb842ac82434416264c2a8e4cc2e9b0
SHA256c1d1c76da5241e76615ed163fa7b64feca7463f70cd4f615459788da4705a73d
SHA512e1b1f1815c661d4287dbfe2f485fbcff90c96e0cd5905a5701527b54fcd36e6cb93f49ce87369a669bc2c5753d78d0af7c889076062f53557600250bb498c25a
-
Filesize
9B
MD57d02194d5f21d1288ee3e3f595122aba
SHA168e51fcc75148bf51da5ad67c7137b85946fc393
SHA256a4da2cd5e1bd5b7cc915b0572d2805cb074c16122fa7e5a41fbc1203aafc3416
SHA512b5aba933dbbe76d9c49da7e4bd9aa8449f164d1a6563feb65e795fd497f42a5c8cc317186adf817990a180e46499987a7403b68b0b089a38ccda0fc9f2dd6c1c