Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe
Resource
win10v2004-20240508-en
General
-
Target
7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe
-
Size
857KB
-
MD5
ae0a75bd41fa2777cc5096949459040a
-
SHA1
6e82d670d5cefe953db3460e0ac5f4b0a81d4dbe
-
SHA256
7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86
-
SHA512
de0031d76adb3a3a9aacebcf3d20dab998cefc50ca304d44e2511ab5037db6b72e2e004eeea346b6eba0a3c9391a62a50f49acfb206ebfa9388cf7ae4c684d27
-
SSDEEP
12288:U7+1X+9w78ram/BfkkHQ08KsRsVzaVtSCUcoMkkvNFx:U7JkAhQ0bsRsVzctSC/oGzx
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1944 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2564 Logo1_.exe 2684 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe -
Loads dropped DLL 2 IoCs
pid Process 1944 cmd.exe 1944 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\CrashReports\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe File created C:\Windows\Logo1_.exe 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe 2564 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1944 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 28 PID 1976 wrote to memory of 1944 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 28 PID 1976 wrote to memory of 1944 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 28 PID 1976 wrote to memory of 1944 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 28 PID 1976 wrote to memory of 2564 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 29 PID 1976 wrote to memory of 2564 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 29 PID 1976 wrote to memory of 2564 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 29 PID 1976 wrote to memory of 2564 1976 7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe 29 PID 2564 wrote to memory of 2712 2564 Logo1_.exe 30 PID 2564 wrote to memory of 2712 2564 Logo1_.exe 30 PID 2564 wrote to memory of 2712 2564 Logo1_.exe 30 PID 2564 wrote to memory of 2712 2564 Logo1_.exe 30 PID 2712 wrote to memory of 2464 2712 net.exe 33 PID 2712 wrote to memory of 2464 2712 net.exe 33 PID 2712 wrote to memory of 2464 2712 net.exe 33 PID 2712 wrote to memory of 2464 2712 net.exe 33 PID 1944 wrote to memory of 2684 1944 cmd.exe 34 PID 1944 wrote to memory of 2684 1944 cmd.exe 34 PID 1944 wrote to memory of 2684 1944 cmd.exe 34 PID 1944 wrote to memory of 2684 1944 cmd.exe 34 PID 2564 wrote to memory of 1192 2564 Logo1_.exe 21 PID 2564 wrote to memory of 1192 2564 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe"C:\Users\Admin\AppData\Local\Temp\7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1D22.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe"C:\Users\Admin\AppData\Local\Temp\7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe"4⤵
- Executes dropped EXE
PID:2684
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2464
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5f71e7ba4cf294c07f1a6fe00f1d19e1f
SHA1eca23c78a597fec55f7ae28f4ebd145949db3230
SHA25633d01dbe53df1e155b5e4fc1bb509ae9ff12221644eca05fafa09e9f4e930ade
SHA51287a335884b3e630400bdbd21c65021e06163165bb86a7252ccfdcb18ae3045fba3c0dae4f88dd6bb62865f7c92bfed08d637ba2bef63a1693fd2d1134725d150
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD574ece0f57274ea21c3ab1a3c528e6bab
SHA1a7662caf2143d09bd3f34f0e53005ce659f6f9f9
SHA256597032f9b263265c92e27a86a8ace4f701f1e2693f3f774e47a6bfe6524e666f
SHA512eca6417e442c6526128b4f6c244e2bed764aa374446cf4ce804485c295a6178eb534412e8161c9d801ddc9f5a8c4fe8e8dedaa40c858963f1c7fa1b15d66c038
-
C:\Users\Admin\AppData\Local\Temp\7719a3589236c9e95cab982476ba737705e31f127dbbc751383e97a417149d86.exe.exe
Filesize830KB
MD50150c09dfd718eac6463f41eee871ef5
SHA179c2962349792be52601f0b630e5333f9be83ca6
SHA2564a4d96e152480140c7ffe0831935f85f06626c4bee80beac536a218f0c1dc60a
SHA51227bedd1f14a504bb9b14f40a543ceea871d03ca98ffde2fc88e2501be56c292666db140f8e2f9ef2e3394e66fd7db23e31061ed133460fa7a3ce04597833a416
-
Filesize
26KB
MD55d0921ed2fc491cb71853329ed6569e2
SHA1830b1053672e0399c1dba422d89d6bf6d11e6a0c
SHA25625f63aa8f7382433eba471f2b9cca34d063eaed487c2607c3364c636c004be08
SHA5121c8b94d6108eb656392ae063e37cd3e1dfd1eff05c4dccf6ed112abd6b8c2199a0fe8bb42b7b95ca124e72d063c14af0d24ce5abb647bb2c1b5526657417d1f0
-
Filesize
9B
MD503c36dbecb7f35761f80ba5fc5566da6
SHA1159b7733006187467bda251a1bbb278c141dceb6
SHA25685a53f5b976fb1c26ce14c31e93c1f68997d2d8b09ab9aa2b7e0d32b8e50ec3b
SHA512fe573085d2abef34adcede2f89b1c2810875ab00ef9ba27a1d95ed1dbe93e182fc53d981901a0b8048dd4eb5fdc852b8f0e0c3a0e1a404cbbe70e13a7a14104a