Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
Resource
win10v2004-20240226-en
General
-
Target
cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe
-
Size
1.2MB
-
MD5
c3e574773d5ebbbdb8f4fd661384e435
-
SHA1
ebf4ca50f1f852079d717db33713042744b8fe76
-
SHA256
cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488
-
SHA512
7fae8f480adb0feb6e2c31475e047953cfb8e134649773ff9d25998cbf2a413a5f11b4c8e008cdf2b728c470646395e26b1a81b32a1ae2a9015d9ce728b8d4ac
-
SSDEEP
24576:U71sQYmz7Gn/jWoHuUDCbmMqWfGL7SiwpCHr0H:U7Lzq/jWoOCUmMqWBvAq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2900 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2948 Logo1_.exe 2532 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe -
Loads dropped DLL 1 IoCs
pid Process 2900 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe File created C:\Windows\Logo1_.exe cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe 2948 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2900 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 28 PID 1740 wrote to memory of 2900 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 28 PID 1740 wrote to memory of 2900 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 28 PID 1740 wrote to memory of 2900 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 28 PID 1740 wrote to memory of 2948 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 29 PID 1740 wrote to memory of 2948 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 29 PID 1740 wrote to memory of 2948 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 29 PID 1740 wrote to memory of 2948 1740 cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe 29 PID 2948 wrote to memory of 2616 2948 Logo1_.exe 31 PID 2948 wrote to memory of 2616 2948 Logo1_.exe 31 PID 2948 wrote to memory of 2616 2948 Logo1_.exe 31 PID 2948 wrote to memory of 2616 2948 Logo1_.exe 31 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2900 wrote to memory of 2532 2900 cmd.exe 33 PID 2616 wrote to memory of 2448 2616 net.exe 34 PID 2616 wrote to memory of 2448 2616 net.exe 34 PID 2616 wrote to memory of 2448 2616 net.exe 34 PID 2616 wrote to memory of 2448 2616 net.exe 34 PID 2948 wrote to memory of 1200 2948 Logo1_.exe 21 PID 2948 wrote to memory of 1200 2948 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aEB.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe"4⤵
- Executes dropped EXE
PID:2532
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2448
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD569e0ff51b5c71d80e8789788f4c0def5
SHA16a167207c2bcfc3af9a3db078cab336c23bff679
SHA2560c795a07deb16a871947caa3fee6505f7645fb2df3b3f33b532b4dc9d4cbe077
SHA5120c9ae6ef006ce63ab0d3d853ffbb8e5bb33bad1367863e07a0a92750d2282dda5f80590883964751260e727bc94f56198e0a24ceb81e689307dda15741d334fa
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
720B
MD53ef1715c9fe6d9ff0c7d316f4950ba39
SHA1503f8aca2e6bccee5b06bf972983282d3fa1ead9
SHA25615152ba815e0cd4df438178d1ee84cb2272155e08e60f89b7ccd47cc2bce19a7
SHA512639242ed3949e5aa22316901aee88a25d5b51690a336d8f3bcdbdd76e10f811943ddd521ebb7ce9b959bf1952222316f0cf410d00023f8b10518f97a421fe557
-
C:\Users\Admin\AppData\Local\Temp\cdf7c214e46de8b6259cb6a91957f8caaacdff0613aa30f8b8d14012693b4488.exe.exe
Filesize1.2MB
MD54d0756eb75a5ea3416008e02ba104333
SHA145219ad56e5361a05fa73d29b75c668a3f00267b
SHA2567cbffb7789087cfcd8dfc2c600cd10e758d5dd3b66e5f38b01f422a358c2a97c
SHA512ac913eceb6e6f66d3827309ce89874365cf98e01f4bb56a83145c16867c388a8a9462bfd972302ee55af446fdb67955a5dba2bfbee1785f15cf2d5f3c6a7c56f
-
Filesize
26KB
MD5eae720ddb96259ba9cc84160c4e6db6b
SHA16e6aa6b84edda1752d2720be3269e5df9a7dbc91
SHA2561e3b3150146e34c2742aa0816cab9a3720ecb9f8e6ad85db6db8624ca6a57760
SHA512a386e5ebbe057131bfcbafcd14f2efe8cb486238394819e681feb1dc7fb5695df660cb2e6dc1ce3a944b1eabc365d91994ed1f137bde0a41d8a4c882428e7610
-
Filesize
8B
MD54b4dbd7e2fe4189c8136069a10e1698a
SHA1e4e6e1e80d1fe41d20456173c522d8e7affc4579
SHA256f00f66ba8f3341c7ae8e3c7741a1ff31e522c75580afa9793dcaee17488ccf5b
SHA5122be5b324ef5d951c5e66d692c26f813e0fdd76cb4ef01a9abf38e5f7837f649e0194f7f5c55b1cfd79a9d253031ace5b270fc50f6c11f1885e85f9a874380d8c