Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe
Resource
win10v2004-20240508-en
General
-
Target
02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe
-
Size
195KB
-
MD5
3d877fea86d6eb8d49e77e4083f4e0da
-
SHA1
39b6103d1bb8f5f97c3b748de06b45224a672b5d
-
SHA256
02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa
-
SHA512
866272c6dde51a46502fae2054f4d296c1246989edb76c238f32dd128c3fdad59b10fe53a2b88afc1b867aa67c597dc3e09fffa34db416e8322d0466edea8256
-
SSDEEP
6144:iFpGhiTM8mP4PnQYg3kMKYMKxbxSELp8Hmr:EpRMuQ93vmq18q
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2976 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1300 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Mail\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Offline\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe File created C:\Windows\Logo1_.exe 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe 1300 Logo1_.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2976 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 28 PID 1424 wrote to memory of 2976 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 28 PID 1424 wrote to memory of 2976 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 28 PID 1424 wrote to memory of 2976 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 28 PID 1424 wrote to memory of 1300 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 30 PID 1424 wrote to memory of 1300 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 30 PID 1424 wrote to memory of 1300 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 30 PID 1424 wrote to memory of 1300 1424 02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe 30 PID 1300 wrote to memory of 3052 1300 Logo1_.exe 31 PID 1300 wrote to memory of 3052 1300 Logo1_.exe 31 PID 1300 wrote to memory of 3052 1300 Logo1_.exe 31 PID 1300 wrote to memory of 3052 1300 Logo1_.exe 31 PID 3052 wrote to memory of 2636 3052 net.exe 33 PID 3052 wrote to memory of 2636 3052 net.exe 33 PID 3052 wrote to memory of 2636 3052 net.exe 33 PID 3052 wrote to memory of 2636 3052 net.exe 33 PID 1300 wrote to memory of 1208 1300 Logo1_.exe 21 PID 1300 wrote to memory of 1208 1300 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe"C:\Users\Admin\AppData\Local\Temp\02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a166E.bat3⤵
- Deletes itself
PID:2976
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2636
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5857901248af73a1d46fb35128c9a14b9
SHA1a28008bc04d56374013386bcf3d5c46b494f1212
SHA256f78337f1a34a4acbc1558a09a2cb8219bf659f12713d81897fd35e978390d250
SHA5120069f75aa493a0874c83cf5c7ad94899801119229e417b7b8df618c8498eb874a4967c17faaacfc88935a121e95699184992ea61323ab25cb7a80c9c52bbab87
-
Filesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
Filesize
722B
MD5ac8d1c16d90dec1933309c087e854935
SHA180506b9675788f74cd8de878fe6175010c338034
SHA2560d0381a3f7d51192c9fb6b72920b29ab8520df0aedcab642444ba1cb6f3df189
SHA5123c6a9a2cb03475b4effd7832081c6042fc74a01bfbd21d7e61bb63de46444112444f55342f9009ccdd7e21143a6c2f1e12a5219ed05d71e9c5bb4b48c1d8b039
-
C:\Users\Admin\AppData\Local\Temp\02463321e53570dfce5840c2dd66efe7fbcaa99dcd8c373dd669a39a649dbcfa.exe.exe
Filesize168KB
MD59865024404b5209cdf2522ceaccb87ef
SHA1c2f2566380930cd5638b9692e9eb579c7e3e66fd
SHA25672e7dcdd653c3171fbf3683aee7fbc91c61f71d62c9f43fe8b2f2e34e9861ee0
SHA51212ed1095164b7dbdd271166a8229bddcabb1c6350678fff4d07c0c338fffd2261a7ae63083a69202b0bb3494139563a1a86e8a3a38efa20c34af50671241b283
-
Filesize
27KB
MD555f44991f5344846e54369e4225e4c48
SHA195d8063218e7a19fa9777ec056fceeb7dbac553b
SHA256cf83b86498be0258d86e0c1a130a28d7b106c43abcceebafac570fc51ae94f74
SHA512a4e60c8378f333ec2e2b27a80ed436d921b3c7dff4ea1727afc79e680ddd9bbcca3de6de5fc1c4c83c5bc6b03c2db03fabcfd431fe9b6ca352d244757c0b4b91
-
Filesize
9B
MD5de299d58575b595bc358a5c5edd0767d
SHA10d30c906a5b5647289c7788d31dd3afd642350a4
SHA25632ef1af1131d89e96d59ac0d3f8e232e839355587a679a2df2479b5277a704e3
SHA512c8e20bb98c427a3a0eea8769df090d59353f0b484321e82b381cfca18b111bd1d782713f2f5bf815e5832a0e12ec909a0324fe9ba013c626327cabf27a464bbc