Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe
Resource
win10v2004-20240508-en
General
-
Target
b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe
-
Size
49KB
-
MD5
ccff02730a6e77d47591a7aba6cf6e1d
-
SHA1
2feb1affda81b9aee5ecfd39babe546300e36e7e
-
SHA256
b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c
-
SHA512
2e7d88bc0b2bdeceb522befc22eddef3ab49dbb1ec7e2643c66b168855f243a62c80c4f4afb146ce5ec414855ed541b7708de63970e397e38c889de497c80fef
-
SSDEEP
768:I1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL31SFUZP5TYi+UAMxkE8:afgLdQAQfcfymNr1dZP5T7lxI
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2516 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2548 Logo1_.exe 2420 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe -
Loads dropped DLL 1 IoCs
pid Process 2516 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\bin\server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5889422B-4E7B-4F63-944F-9F172CF77CBB}\chrome_installer.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe File created C:\Windows\Logo1_.exe b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe 2548 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2516 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 28 PID 1876 wrote to memory of 2516 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 28 PID 1876 wrote to memory of 2516 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 28 PID 1876 wrote to memory of 2516 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 28 PID 1876 wrote to memory of 2548 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 29 PID 1876 wrote to memory of 2548 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 29 PID 1876 wrote to memory of 2548 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 29 PID 1876 wrote to memory of 2548 1876 b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe 29 PID 2516 wrote to memory of 2420 2516 cmd.exe 32 PID 2516 wrote to memory of 2420 2516 cmd.exe 32 PID 2516 wrote to memory of 2420 2516 cmd.exe 32 PID 2516 wrote to memory of 2420 2516 cmd.exe 32 PID 2548 wrote to memory of 2512 2548 Logo1_.exe 31 PID 2548 wrote to memory of 2512 2548 Logo1_.exe 31 PID 2548 wrote to memory of 2512 2548 Logo1_.exe 31 PID 2548 wrote to memory of 2512 2548 Logo1_.exe 31 PID 2512 wrote to memory of 2592 2512 net.exe 34 PID 2512 wrote to memory of 2592 2512 net.exe 34 PID 2512 wrote to memory of 2592 2512 net.exe 34 PID 2512 wrote to memory of 2592 2512 net.exe 34 PID 2548 wrote to memory of 1160 2548 Logo1_.exe 21 PID 2548 wrote to memory of 1160 2548 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe"C:\Users\Admin\AppData\Local\Temp\b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a5918.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe"C:\Users\Admin\AppData\Local\Temp\b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe"4⤵
- Executes dropped EXE
PID:2420
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2592
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5533ce215a7c274602dc456ca375cef93
SHA176c502d7c45eca3fd96f6b04eb850e751bc785dd
SHA256d70c9f73bbeed5cbc0df4a4d14bae68789f84d8092281337d2919322b288ce9c
SHA51209d9dee36c48567921de4b7c31c4a822d5f9ed5e0b1cb0330031b320f40b5ba9b15e89dc37d52561094642c0ff16c14d32e81ed5b1dac06150fefbbd6f3365bf
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD5246be4b3b2f38ce973d49c98203bfc28
SHA1caf0b296f4f13916876c707a578cbffea551a972
SHA256535115d968bc075d34488559c92aa3fd163e66d28ff5642c377d85930093180c
SHA512c7eb0c6bcea69098feacf142c1b251297d2db6e1ff4d9df3342fd16e2501224644faf0fdbc5810e8c1eaaf7d19abe8fb46e0d98cf4f9effa68238cbe48c7b102
-
C:\Users\Admin\AppData\Local\Temp\b7c665a943995a9e3df1600d7ca2eeddd0d5d80bc22e03150b590c48aca9984c.exe
Filesize23KB
MD53c85f5e1f38b3b8176c0580debb48d38
SHA1422e4f21186268066d30ad882ec66ed41c322a5c
SHA256bf12b0043439b9ec8542e60374a4956b21cf300c94a779875f1715a10326353a
SHA5122c8d3375ea1dbfabef36df5e22e22a1204545c86fae81c402abe55628d2b6617099f2713b1dbbcaba81c94d1788de25909ca162fed03a8d161f6008927c61889
-
Filesize
26KB
MD5925efa8e6ec043b04fdaf9e6c9f95b9f
SHA14bb883e016bdeecc3f21b562df6364944b777ae3
SHA2566513ef9968b68f982fb83460b5919e55470f514db71c3831c2ea5c7b3a2721db
SHA512bf4978b5b10932de14d0c64566768708331f89a815f153323173506aecc296236a22d387b5caceba100c72b44e6b870e879f7350f1abce413bb92d54e70b133e
-
Filesize
9B
MD52822854d33e24347f613c750df46b810
SHA1c2ea2529c032aa552d5a8301900cf27fc0f6045c
SHA25673f2f888bdeaf9427c7aa3355fbe711e6570fb5e9e48c3f64cd229198ce85ad2
SHA51221fff5d14e03a0420d9242a095c2e93ac2b7e6b9e49d12da907394ac9725bb746896721ceded88411895e9630a8ffbface168f0c02630b33300647d3d9e3326c