Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
Resource
win10v2004-20240611-en
General
-
Target
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe
-
Size
563KB
-
MD5
667e85bd4dde4229556b4c184abc6315
-
SHA1
efca5158bccfd76802fa812678edd1efc332096f
-
SHA256
b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d
-
SHA512
7e3db649c845d78fc995347adfba86f575ecdd7a7e42d783a12990abaf8a9af1a1e483b60dd548521ab21ee074ed07fb01e3d79bca5db08e41d3609407fc318f
-
SSDEEP
12288:x7+HLc+Gl3DflwlLrfw+fZdI+eN9K61cNiSvSGtTnOmyMcp7YJhne:x72c+qILkOdIdcN/vvtTObMceJhe
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1724 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2264 Logo1_.exe 1572 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe -
Loads dropped DLL 1 IoCs
pid Process 1724 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe Logo1_.exe File created C:\Program Files\Windows Journal\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Portable Devices\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5CF72A45-AD68-472B-BBFF-38A947BD74EE}\chrome_installer.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe File created C:\Windows\Logo1_.exe b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe 2264 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1724 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 28 PID 2176 wrote to memory of 1724 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 28 PID 2176 wrote to memory of 1724 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 28 PID 2176 wrote to memory of 1724 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 28 PID 2176 wrote to memory of 2264 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 29 PID 2176 wrote to memory of 2264 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 29 PID 2176 wrote to memory of 2264 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 29 PID 2176 wrote to memory of 2264 2176 b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe 29 PID 2264 wrote to memory of 1904 2264 Logo1_.exe 31 PID 2264 wrote to memory of 1904 2264 Logo1_.exe 31 PID 2264 wrote to memory of 1904 2264 Logo1_.exe 31 PID 2264 wrote to memory of 1904 2264 Logo1_.exe 31 PID 1724 wrote to memory of 1572 1724 cmd.exe 34 PID 1724 wrote to memory of 1572 1724 cmd.exe 34 PID 1724 wrote to memory of 1572 1724 cmd.exe 34 PID 1724 wrote to memory of 1572 1724 cmd.exe 34 PID 1904 wrote to memory of 1804 1904 net.exe 33 PID 1904 wrote to memory of 1804 1904 net.exe 33 PID 1904 wrote to memory of 1804 1904 net.exe 33 PID 1904 wrote to memory of 1804 1904 net.exe 33 PID 2264 wrote to memory of 1192 2264 Logo1_.exe 21 PID 2264 wrote to memory of 1192 2264 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a24A0.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe"4⤵
- Executes dropped EXE
PID:1572
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1804
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD514ade88c5dc82b0bfa12f95ef44d65e8
SHA17ec030c11b167d19fbbdc0283ad581593f3e0c68
SHA2564eed98e322b4876e43df6d22b1cd2c7ffd4e7b0ca4fdf4e1d512c040889f6e50
SHA512c9af793ec2a3b508d17e63f3ebe82a021a9f45849ea90473befdd4739a5536b6a08326214870aa7315bfa2e36b06629b8d6e4746e20260108cd9a608c5157eff
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5616ca5bca81b44cb8e52d5600ba59ae7
SHA11a22a7c36e78c0b85dfb63730dc657738f1381fe
SHA25678080d9f27e21f4bae08daeea847421d843961bdd7fc8918c8dc6169032a5964
SHA51216c8596b1d3a11ff843b8c9f297a0bdd35be89a5d1a93eb9a592ad640e411d99fec28185dadf3b828d85316c385aecea59df844d27b306a633e513100663ee10
-
C:\Users\Admin\AppData\Local\Temp\b2506e70d2086cb4b515c1c94995bdd22560dc336e05550f6ce917ad08d6cb8d.exe.exe
Filesize537KB
MD51693ec6b9172f769440a61f39dc4ec23
SHA1784211d8def7e5047b16858773c1f898e853c761
SHA256d03eb23ef9eaf78e92d7db8febdd0c58bba0c8fa180af3ecb9112d7b5e02ddaa
SHA512059903839564e19b17d9e096db365c643079a68ace6e78b704810e81c57c04788621f987932c2947821ebda01cc3319c646dcde0d04f8cb736128debaade4df0
-
Filesize
26KB
MD502a751086e70575a0d1fd2ddb0c828f5
SHA153368acb3a3ec94af65b4fb645311ae861e15896
SHA256bd1b420c600a7fbd919550599f2521bc8100d716025ebec0872565bada4ab974
SHA5125cf5d7066eabb389373ab48945dc35c23175bd1172a951f18b88d1db80b4b244a78df62a1d30073eb69a31dcf8ef0fb30f61274a3fa7ff1ce56806b7852a08c9
-
Filesize
9B
MD57905486656bdf3fb568c8ea7abf7bda1
SHA149bd27ff3dcc248ecab0f726abb60ca35dc0e78c
SHA256238153572e1dcd784aa47b53eba4a41558719a908862c7b3d186928fb0237b09
SHA512b981b1fd177812b877c92b63b7261d2951b98871da87c20232cb70317a68694d7f7b24cf2f01bc3db01f192b2b8b84c7569a2472204ec4e66226d1efd14c9c14