Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
Resource
win10v2004-20240508-en
General
-
Target
109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
-
Size
573KB
-
MD5
4c40da2c299470aff4edf636d594d13b
-
SHA1
6491a499509372897548f7e1e5d58f60b481570a
-
SHA256
109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc
-
SHA512
c409c8c2d1741ff3c2419e589d3c9bcdb776d5a5ac174516e7b9a40e9f707ad48ca0036e255e2499845b163575dc838d17614b5341d1b15b29f4a7b887e58af0
-
SSDEEP
6144:MtuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:s7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2700 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2804 Logo1_.exe 2636 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe -
Loads dropped DLL 1 IoCs
pid Process 2700 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe File created C:\Windows\Logo1_.exe 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe 2804 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2700 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 28 PID 1944 wrote to memory of 2700 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 28 PID 1944 wrote to memory of 2700 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 28 PID 1944 wrote to memory of 2700 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 28 PID 1944 wrote to memory of 2804 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 29 PID 1944 wrote to memory of 2804 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 29 PID 1944 wrote to memory of 2804 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 29 PID 1944 wrote to memory of 2804 1944 109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe 29 PID 2804 wrote to memory of 2728 2804 Logo1_.exe 31 PID 2804 wrote to memory of 2728 2804 Logo1_.exe 31 PID 2804 wrote to memory of 2728 2804 Logo1_.exe 31 PID 2804 wrote to memory of 2728 2804 Logo1_.exe 31 PID 2700 wrote to memory of 2636 2700 cmd.exe 33 PID 2700 wrote to memory of 2636 2700 cmd.exe 33 PID 2700 wrote to memory of 2636 2700 cmd.exe 33 PID 2700 wrote to memory of 2636 2700 cmd.exe 33 PID 2728 wrote to memory of 1240 2728 net.exe 34 PID 2728 wrote to memory of 1240 2728 net.exe 34 PID 2728 wrote to memory of 1240 2728 net.exe 34 PID 2728 wrote to memory of 1240 2728 net.exe 34 PID 2804 wrote to memory of 1180 2804 Logo1_.exe 21 PID 2804 wrote to memory of 1180 2804 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a274F.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"4⤵
- Executes dropped EXE
PID:2636
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1240
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5f134d58f0c72c193a05ff5819d09f8d6
SHA185c6d5b8cb938c5b8b7437693a4f6e97caa94fdf
SHA2560b329835e955ce06b673448b91b9bea022bc741cd855123dd5f8988d4385b031
SHA51227c84f45bacb5c95ca340b6a8da7a81ece4cdb3adf2c3f85726f79c7a35cf7b6eb37c6703b6c275d5861ea0585c43c2bbc95f5331aec240ee234fceb72ed33c6
-
Filesize
474KB
MD539d0021b923509b5e31096b0f119bada
SHA15cdb5aacdc36fc52472de30f738c1770c0be28fa
SHA2566245380525c0df016952045413482bc868b12263353c73d1834e268a634fbd1c
SHA512eb9a24f56f778ab8738acef21ec58815e108f2bfe69d4dfb28c1628a67e0037bcc557591fcdf754815351a8da77fd0315a1271ac1a5ac6d9b3e6c3822519c1cf
-
Filesize
722B
MD56d6fabf62b030b0af44bec7b898b2c3e
SHA1f274769364050270a5b2f0c7100a44eeaa5002bc
SHA256e48de6a090bb8c54a82afa7c470e5abe305292f17e937bcad2d676f140656cd7
SHA5126fe38b0641668511b5881ba70f6be8931a00427690c36360263f786170cb6cec5bd3f182d962fb922cc65986105deb2198d8ed700988d891b8ab02654209aec6
-
C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
29KB
MD5af29fb6a5adf025d9127df13f942d7d2
SHA172d13969443440eb123cfb43f924c4959eae7638
SHA256d83088ef692a221a033bfb31d7178f7f04182df4480ac946b53807fda9cdd040
SHA51210c6c2a56386b35f52e8b220def9cace7a57a70672a97aeb3c95df14d832416d6057fabccd86c4f473e354a87e378ff0ac3cf0e503ee3db9f909897ef7776079
-
Filesize
9B
MD5392ab9dcf5a9daf53626ea1f2e61d0b9
SHA10a2cdc7f8f9edf33f9fde3f8b90e0020190c8fb7
SHA2569bbc94aad502d7d7a7f502ddb9cbd93b1c89eff13e445971c94ac09215ada67d
SHA5125d1fea63a7793a65dc63c32cfe3ab2e1af941ded8e760f08fbe991e5b30433f86f920d717235a635020740c8f6f7996b4b8e8147e331b29141fcbb7bdc68144d