Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
Resource
win10v2004-20240508-en
General
-
Target
35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
-
Size
384KB
-
MD5
ff106ac5c416d17141a11f322d0cf49a
-
SHA1
141992e18745abcae416e9ce3e99acb6663126ec
-
SHA256
35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e
-
SHA512
c523e4c9d04e58d8edddc44584360110ce2ae79987a130015cd3a1585ced6884ab2c33c3fd1c9fbd1a8147abdff8ae09f506f2e32e67ce573786641a2678028e
-
SSDEEP
3072:xAyLd0K/JdOj7Yhy2j14ml3I2LDZm1bRxH2gVMnayzmXtMqRnf1UEDiMvTCfrqUQ:XLZ/Jduwy4ScLZIxH2gGanTf1n
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1216 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2540 Logo1_.exe 2804 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe -
Loads dropped DLL 1 IoCs
pid Process 1216 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe 2540 Logo1_.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1216 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 28 PID 2180 wrote to memory of 1216 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 28 PID 2180 wrote to memory of 1216 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 28 PID 2180 wrote to memory of 1216 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 28 PID 2180 wrote to memory of 2540 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 29 PID 2180 wrote to memory of 2540 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 29 PID 2180 wrote to memory of 2540 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 29 PID 2180 wrote to memory of 2540 2180 35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe 29 PID 2540 wrote to memory of 2676 2540 Logo1_.exe 30 PID 2540 wrote to memory of 2676 2540 Logo1_.exe 30 PID 2540 wrote to memory of 2676 2540 Logo1_.exe 30 PID 2540 wrote to memory of 2676 2540 Logo1_.exe 30 PID 2676 wrote to memory of 2704 2676 net.exe 33 PID 2676 wrote to memory of 2704 2676 net.exe 33 PID 2676 wrote to memory of 2704 2676 net.exe 33 PID 2676 wrote to memory of 2704 2676 net.exe 33 PID 1216 wrote to memory of 2804 1216 cmd.exe 34 PID 1216 wrote to memory of 2804 1216 cmd.exe 34 PID 1216 wrote to memory of 2804 1216 cmd.exe 34 PID 1216 wrote to memory of 2804 1216 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a2E70.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"3⤵
- Executes dropped EXE
PID:2804
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2704
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD592c9f1ee3e22d83ea786ecd999ea0c0e
SHA19f0788deb9bceaa353333d4f8f683428691d32de
SHA25669a54c0ef424596175e61f9b8f491619b2adf8f0483fecd310da9998db71e242
SHA5125be4741162dfd0a8d1e14e79ac4750303614a5ee7fed811a73534bef7b248f7cf36b05fdd6e89dd7cd923a7a14c95a24fecd5c72dcc93729c5f2c9b4acd94f97
-
C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe.exe
Filesize318KB
MD5dca5924a3197b5b6925ca549033ff0b7
SHA1c10dfc045a860d4da749b60c06535f3270d74222
SHA256a2206ce83f0270a4b93fc3ac0dd704355c5bd18535b3b642d64bd6f54f08df55
SHA5127a7fb359add41605b93c992edadd68a5f33dc7b675e64cff38d234e8b060a0406dbcd7cf7226cbdd6233f560e6e56ec9b47386be1ad9b2232bcff09ae34d7455
-
Filesize
66KB
MD59e55800e061b59df24521a41562b45e8
SHA166b0c3b70118debcbaa22fe6fb26e7b0f04d0110
SHA25605e7905abaaab25a826c585f6682248ce8f02f5a572c869e248b3604daf7fc6b
SHA512535b6f620688da3b27679453f04b7a5a57c924258cb382ae60838f1653f83214e0fcbb8c053632055068f747ae78c7a4b9aeb91ec2c37247b6a5d96424c25f65