Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe
Resource
win10v2004-20240426-en
General
-
Target
eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe
-
Size
68KB
-
MD5
6a5ba4066e40dd9bf9772295c5f2c6ba
-
SHA1
d71fa514a359f5ac2bf7a6f245cfd81d92d472d6
-
SHA256
eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b
-
SHA512
9e5626387138cc68ffef1e206486bb234001d6c73395c0303e294a06792c682244787996a29e44f861d08ff9250852b60a549893bccfdfd009c19e78adca89ee
-
SSDEEP
1536:JLz3SHmLKarIpYeEToa9D4ZQKbgZi1dst7x9PxQ:VkF3pdlZQKbgZi1St7xQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2984 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2592 Logo1_.exe 1944 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe -
Loads dropped DLL 1 IoCs
pid Process 2984 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am_ET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Uninstall Information\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe File created C:\Windows\Logo1_.exe eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe 2592 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2984 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 28 PID 1924 wrote to memory of 2984 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 28 PID 1924 wrote to memory of 2984 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 28 PID 1924 wrote to memory of 2984 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 28 PID 1924 wrote to memory of 2592 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 30 PID 1924 wrote to memory of 2592 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 30 PID 1924 wrote to memory of 2592 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 30 PID 1924 wrote to memory of 2592 1924 eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe 30 PID 2592 wrote to memory of 2604 2592 Logo1_.exe 31 PID 2592 wrote to memory of 2604 2592 Logo1_.exe 31 PID 2592 wrote to memory of 2604 2592 Logo1_.exe 31 PID 2592 wrote to memory of 2604 2592 Logo1_.exe 31 PID 2984 wrote to memory of 1944 2984 cmd.exe 34 PID 2984 wrote to memory of 1944 2984 cmd.exe 34 PID 2984 wrote to memory of 1944 2984 cmd.exe 34 PID 2984 wrote to memory of 1944 2984 cmd.exe 34 PID 2604 wrote to memory of 2724 2604 net.exe 33 PID 2604 wrote to memory of 2724 2604 net.exe 33 PID 2604 wrote to memory of 2724 2604 net.exe 33 PID 2604 wrote to memory of 2724 2604 net.exe 33 PID 2592 wrote to memory of 1136 2592 Logo1_.exe 20 PID 2592 wrote to memory of 1136 2592 Logo1_.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aFBA.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"4⤵
- Executes dropped EXE
PID:1944
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2724
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5e51b1ea24d8739a33beec03e98ea799d
SHA1359852502dbf1c0e6a5b42f9bd279e3a164c5059
SHA256bfee2fff789c9b51161e79e8d91a226773e5dfb5deb5f8bd2eb94d6cae2d9a61
SHA51204659e8f2d599e4bc36589034ca1b8639e831f2a440ff2dc3c109b73a4d5372b34a43e1a09985623e4f7fac6fd3a4fd1255b591e88cadf234cc20c18c198c10a
-
Filesize
472KB
MD588eb1bca8c399bc3f46e99cdde2f047e
SHA155fafbceb011e1af2edced978686a90971bd95f2
SHA25642fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428
SHA512149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728
-
Filesize
721B
MD50b2d719749f4116ad3b16da56ce8151a
SHA1c56fbc598aeb41838de90b5ef15400de15358450
SHA256861db32baf179949ebc4ac60848a9d18afcdee6ae13274ad4bfbea78490d6482
SHA51220ec6d20571e0592f5dd87b1ce7dcd09d0e6996211eaab9dc662e6bdb76ee4259835881ddfed44ad4f79a6c60aabee681bcce21ad546dddc32728ecca9e68c02
-
C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe.exe
Filesize41KB
MD5977e405c109268909fd24a94cc23d4f0
SHA1af5d032c2b6caa2164cf298e95b09060665c4188
SHA256cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
SHA51212b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
-
Filesize
27KB
MD5e64ef364d16ee5080d92a0ce29745a57
SHA17cad20f8448225d876c51f447fce237435653013
SHA2565bf21661082873e033505e0da51c119acaba12a6d18df121d44e6665a5a065bc
SHA512f483b17532fb65a90952fc4a14492ee29109c1a69b34cfdbde19059438d14d3e42ce7e893f0c4fd794979a5055cc48613cf64486f8e27103b469100f8d1b1ff3
-
Filesize
8B
MD502e4d47cbb9cf2affe1a6d96af753a42
SHA1fe76259bc3376a8aa287867933c6bfd7fdae1944
SHA2568079d35a07b892f00cdffeed754377382353a6e5870c06c02dc8dbaf809d291a
SHA512cc47f23bb8b014458285ee912566350c0d09c49d9e40666790694b4d4d7961abbf7adcf9d54e78571a3b97d27a05c58f3db3fdaaa3f4221130a248ed780a1746