Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe
Resource
win7-20240220-en
General
-
Target
17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe
-
Size
70KB
-
MD5
9844f26c45f21499d4913c310a485245
-
SHA1
aadb779a5ba654305a7091f4f91d504d116d39e7
-
SHA256
17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d
-
SHA512
ec34d16e0cebd1f9e319a8d67bb316fc0811cd2473bb1a5c6c7fda8332a4bebc8a6f06da3473ff277ca8cbdb760325f6e5770f7691e5594eb7fbf41789a2551c
-
SSDEEP
1536:Ig8Ze+Zk77RNzLiTOPriw+d9bHrkT5gUHz7FxtJ:Igae+aX3zvPrBkfkT5xHzD
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2728 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2552 Logo1_.exe 2424 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe -
Loads dropped DLL 1 IoCs
pid Process 2728 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe File created C:\Windows\Logo1_.exe 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe 2552 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2588 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 28 PID 1992 wrote to memory of 2588 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 28 PID 1992 wrote to memory of 2588 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 28 PID 1992 wrote to memory of 2588 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 28 PID 2588 wrote to memory of 2976 2588 net.exe 30 PID 2588 wrote to memory of 2976 2588 net.exe 30 PID 2588 wrote to memory of 2976 2588 net.exe 30 PID 2588 wrote to memory of 2976 2588 net.exe 30 PID 1992 wrote to memory of 2728 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 31 PID 1992 wrote to memory of 2728 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 31 PID 1992 wrote to memory of 2728 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 31 PID 1992 wrote to memory of 2728 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 31 PID 1992 wrote to memory of 2552 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 33 PID 1992 wrote to memory of 2552 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 33 PID 1992 wrote to memory of 2552 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 33 PID 1992 wrote to memory of 2552 1992 17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe 33 PID 2552 wrote to memory of 2556 2552 Logo1_.exe 34 PID 2552 wrote to memory of 2556 2552 Logo1_.exe 34 PID 2552 wrote to memory of 2556 2552 Logo1_.exe 34 PID 2552 wrote to memory of 2556 2552 Logo1_.exe 34 PID 2728 wrote to memory of 2424 2728 cmd.exe 36 PID 2728 wrote to memory of 2424 2728 cmd.exe 36 PID 2728 wrote to memory of 2424 2728 cmd.exe 36 PID 2728 wrote to memory of 2424 2728 cmd.exe 36 PID 2556 wrote to memory of 1680 2556 net.exe 37 PID 2556 wrote to memory of 1680 2556 net.exe 37 PID 2556 wrote to memory of 1680 2556 net.exe 37 PID 2556 wrote to memory of 1680 2556 net.exe 37 PID 2552 wrote to memory of 2564 2552 Logo1_.exe 38 PID 2552 wrote to memory of 2564 2552 Logo1_.exe 38 PID 2552 wrote to memory of 2564 2552 Logo1_.exe 38 PID 2552 wrote to memory of 2564 2552 Logo1_.exe 38 PID 2564 wrote to memory of 2396 2564 net.exe 40 PID 2564 wrote to memory of 2396 2564 net.exe 40 PID 2564 wrote to memory of 2396 2564 net.exe 40 PID 2564 wrote to memory of 2396 2564 net.exe 40 PID 2552 wrote to memory of 1136 2552 Logo1_.exe 20 PID 2552 wrote to memory of 1136 2552 Logo1_.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe"C:\Users\Admin\AppData\Local\Temp\17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1D7F.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe"C:\Users\Admin\AppData\Local\Temp\17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe"4⤵
- Executes dropped EXE
PID:2424
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1680
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2396
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD581a0e302bbfd88e0fa1e7a21dec03386
SHA1423f9191a497994c2fb959806c9ad0ef5b678d0c
SHA2568f8b833c8ee99eb2bdcf44ae370ed5505681331b52adc56815d96a263e60cbe7
SHA512b4b05481f1026a2aff43ae42416c943902f87ddab8941fab5c8f4875956fcc67e8ce66acb4a7e98d705769b75c01beb0a9be279b29c8a2e9dfe5ae96bb742d00
-
Filesize
478KB
MD558e981aa689693f5695bae5cb00cfa39
SHA1d8d4575dd3f2aaed503388aae63b3a947f7a7e82
SHA2560947128e04349f2829e54dad392e85b448539782dfcc666e382b361e9489a488
SHA512e41d12ba89eac143445597ddbc7bab2945b273acc26a49ea7982864be31ae3c3ec6838b3f237b6285e8c1ba6cd15161736bcb88a75dde093f9a1916e7c938661
-
Filesize
722B
MD510f528ca48b29ca3d98cba665cafd675
SHA1f7882c8edd422b8767723abb1f5d5ee3eabf112a
SHA256760243388e8057ef845f109ec1884ebd4a3e78346c33a816c7768252d17caa9a
SHA512bdb80487414dd960d105b166e8e48cbf6093f4d836acd954a2f64b6e0dfa276587bcb38f2797939408c8e284e298a3aac666d179f9e2fabd5d165cab16bf614a
-
C:\Users\Admin\AppData\Local\Temp\17ed23ca5fae59814a518fecadcb203822d63bcf78f333d77c30395da999340d.exe.exe
Filesize36KB
MD59f498971cbe636662f3d210747d619e1
SHA144b8e2732fa1e2f204fc70eaa1cb406616250085
SHA2568adf6748981c3e7b62f5dbca992be6675574fffbce7673743f2d7fe787d56a41
SHA512b73083c2f7b028d2946cb8f7b4fe2289fedaa4175364a2aac37db0aeff4602aede772ccc9eba7e6dcfcb7276e52604ca45d8021952201b5834485b48bca3dc93
-
Filesize
33KB
MD5420f125d677f0bf19d6130ea59dfb694
SHA1c26ae0c439982374d7ed6db90761cdb1d4f2f617
SHA2564784cbb5bf5947b0729e72958deb0c4f12222523aee7f3c19856e16f9e2068d2
SHA51223cc499e39b347ecd15b6ba5eafd3455295bcf0508b14e65c24928cb9e6d90d5c324ae3687186b954d4549dccce2087f08fda10bbf1205b19df74ef6b1a773ee
-
Filesize
8B
MD50282826728a8bfe9c3f290391e4f323c
SHA1ab69946ecc2824015e04a669b8434e8eb2a658aa
SHA2560c3ddb95f5308286721e2d55c16a3170674b54fc8d17c1f02bee1b6850ce2ee9
SHA512fde2cb3a9b14fa79fdb7615c094a85aee3baf100511872c0b3986349edefe5a2dc4513929587852c1672e9632c8a6c95284fab82397133dec597bb8fe618fb0e