Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe
Resource
win7-20240508-en
General
-
Target
2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe
-
Size
258KB
-
MD5
5bccfa5d3d7bcee768187346a73608d1
-
SHA1
4ea22c666a8ffe6e0f03607e45a85deba5484cb1
-
SHA256
2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba
-
SHA512
28be9c9b18f9db60abb7b13ba92152278e650e59e76843bb4143f3375f23ac5e08cf45a209a13c4ca916e27555a45836ddd066544f9e9d6e4d8c49a4eac7e7e4
-
SSDEEP
6144:S+aezDQZbO5JCSZT0wwla4G13CmdxLzI9LTB5xnmT:S+aRbuJcfcXbz0Tfxo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2704 cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 2324 Logo1_.exe 2616 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1224 Explorer.EXE -
Loads dropped DLL 1 IoCs
pid Process 2704 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File created C:\Program Files\Windows Journal\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe File created C:\Windows\Logo1_.exe 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe 2324 Logo1_.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1896 wrote to memory of 1240 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 28 PID 1896 wrote to memory of 1240 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 28 PID 1896 wrote to memory of 1240 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 28 PID 1896 wrote to memory of 1240 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 28 PID 1240 wrote to memory of 2092 1240 net.exe 30 PID 1240 wrote to memory of 2092 1240 net.exe 30 PID 1240 wrote to memory of 2092 1240 net.exe 30 PID 1240 wrote to memory of 2092 1240 net.exe 30 PID 1896 wrote to memory of 2704 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 31 PID 1896 wrote to memory of 2704 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 31 PID 1896 wrote to memory of 2704 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 31 PID 1896 wrote to memory of 2704 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 31 PID 1896 wrote to memory of 2324 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 33 PID 1896 wrote to memory of 2324 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 33 PID 1896 wrote to memory of 2324 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 33 PID 1896 wrote to memory of 2324 1896 2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe 33 PID 2324 wrote to memory of 2816 2324 Logo1_.exe 34 PID 2324 wrote to memory of 2816 2324 Logo1_.exe 34 PID 2324 wrote to memory of 2816 2324 Logo1_.exe 34 PID 2324 wrote to memory of 2816 2324 Logo1_.exe 34 PID 2816 wrote to memory of 2620 2816 net.exe 36 PID 2816 wrote to memory of 2620 2816 net.exe 36 PID 2816 wrote to memory of 2620 2816 net.exe 36 PID 2816 wrote to memory of 2620 2816 net.exe 36 PID 2704 wrote to memory of 2616 2704 cmd.exe 37 PID 2704 wrote to memory of 2616 2704 cmd.exe 37 PID 2704 wrote to memory of 2616 2704 cmd.exe 37 PID 2704 wrote to memory of 2616 2704 cmd.exe 37 PID 2324 wrote to memory of 2848 2324 Logo1_.exe 38 PID 2324 wrote to memory of 2848 2324 Logo1_.exe 38 PID 2324 wrote to memory of 2848 2324 Logo1_.exe 38 PID 2324 wrote to memory of 2848 2324 Logo1_.exe 38 PID 2848 wrote to memory of 2676 2848 net.exe 40 PID 2848 wrote to memory of 2676 2848 net.exe 40 PID 2848 wrote to memory of 2676 2848 net.exe 40 PID 2848 wrote to memory of 2676 2848 net.exe 40 PID 2324 wrote to memory of 1224 2324 Logo1_.exe 21 PID 2324 wrote to memory of 1224 2324 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2092
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a35DF.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"4⤵
- Executes dropped EXE
PID:2616
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2620
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2676
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
MD57b714d463f7db900d5b6e757778a8ab8
SHA12cfc0e9f54236af8e10b0bfa551d87a20982b733
SHA256c995370836939a29853611830ca08d437286d4f45603edce88f36aa1f99a0d97
SHA512e8fe8823b5b7f282c24c964cbf4f248b7562259a13410bf95997288727f9bfc6ea51c4aa40182b649a2235bafc02062e0c57f4f62876b5174395071a8d68f9bb
-
Filesize
722B
MD521b31a5ffe114abc5801a4a99698d4ce
SHA170d23caaffac81b02b5dde0c8c5f1f361a5a619d
SHA256a7194ace2e0a5c7da00f9dd40d462e5fb125487032aa7039c0d49ceaacea3938
SHA512729404ada4d6436307e4892b20efb3e5f02801e76360f23550fea6a6b74da6cb925e8c2a45dfe221c383ce9159cf1f8b42806aa0f88d8de139b95ba8af597c78
-
Filesize
39KB
MD53119e880ce5d6d029185f7ed591e11d0
SHA13ab197daedf94e992062faa4eda18905b87c75bb
SHA256b1eada5fd013195853bb65ee2b9fa55eb97840d20077d7a2fd43167800608eda
SHA51218cafd3a73312811037cb0e44a578670498b09350d72febd262d62528094b9ba738357ef861bb9cb7704097b9c930b9aa38ee5823520e22cf71d4ebb453bf4d7
-
Filesize
9B
MD560b1ffe4d5892b7ae054738eec1fd425
SHA180d4e944617f4132b1c6917345b158f3693f35c8
SHA2565e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4
SHA5127f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc
-
\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe
Filesize218KB
MD55f1707646575d375c50155832477a437
SHA19bcba378189c2f1cb00f82c0539e0e9b8ff0b6c1
SHA25675d348a3330bc527b2b2ff8a0789f711bd51461126f8df0c0aa1647e9d976809
SHA5122f55dd13abfeb5af133ac5afb43c90fd10618e8fb241f50529241cff7987fff382cf151146855c37ad8ae0401b34f6d9aa32cbec03cdd67a224dfe247bad6c99