Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 08:52
Static task
static1
Behavioral task
behavioral1
Sample
512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
Resource
win10v2004-20240709-en
General
-
Target
512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe
-
Size
70KB
-
MD5
892772aa0331b21a22e480928647f38f
-
SHA1
eb0aa18bd65f530c866b32962436a9993d4fca57
-
SHA256
512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3
-
SHA512
19ed9aa4c06759824f8cdfc36b5843f05baffbb1cd8463a219030551304a4a212700c31fda7c7180b40c056aa572dff13f4cc176b3dcf5702fd98652bf57946a
-
SSDEEP
1536:ps3SHuJV9NdEToa9D4ZQKbgZi1dst7x9PxQ:pskuJVLtlZQKbgZi1St7xQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2492 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2052 Logo1_.exe 2504 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe -
Loads dropped DLL 1 IoCs
pid Process 2492 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Solitaire\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe File created C:\Windows\Logo1_.exe 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe 2052 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2492 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 30 PID 2332 wrote to memory of 2492 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 30 PID 2332 wrote to memory of 2492 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 30 PID 2332 wrote to memory of 2492 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 30 PID 2332 wrote to memory of 2052 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 31 PID 2332 wrote to memory of 2052 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 31 PID 2332 wrote to memory of 2052 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 31 PID 2332 wrote to memory of 2052 2332 512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe 31 PID 2492 wrote to memory of 2504 2492 cmd.exe 34 PID 2492 wrote to memory of 2504 2492 cmd.exe 34 PID 2492 wrote to memory of 2504 2492 cmd.exe 34 PID 2492 wrote to memory of 2504 2492 cmd.exe 34 PID 2052 wrote to memory of 2000 2052 Logo1_.exe 33 PID 2052 wrote to memory of 2000 2052 Logo1_.exe 33 PID 2052 wrote to memory of 2000 2052 Logo1_.exe 33 PID 2052 wrote to memory of 2000 2052 Logo1_.exe 33 PID 2000 wrote to memory of 2268 2000 net.exe 36 PID 2000 wrote to memory of 2268 2000 net.exe 36 PID 2000 wrote to memory of 2268 2000 net.exe 36 PID 2000 wrote to memory of 2268 2000 net.exe 36 PID 2052 wrote to memory of 1204 2052 Logo1_.exe 21 PID 2052 wrote to memory of 1204 2052 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aBF78.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe"4⤵
- Executes dropped EXE
PID:2504
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2268
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5c420c4af538b11e5654382b1b95c1f74
SHA1b9c6a3a3f463948c25e162214d064039eb394b1b
SHA2561605b0cd978c5eea742ac6c780774a1c921791a0b8efb5a4df0ef8243db956ce
SHA512094687162f991b97ebc4a6b9f9bf0de05631ddde6fbec11595948c7c3ebdd1dd4e3d34bddd470beee8614d6c9533c394b4c700664ce0c41ee52df6e192bc1526
-
Filesize
474KB
MD52faaad87f08521fcc8daee0d433d478b
SHA1a75b87049a6c122b921f66cddeabb12502857a2f
SHA25670546de82df8bdbcd9022e1bd74a8f50d61dd19532aeaa32a69582acda025b25
SHA5121dff24a69a25f323075c8553c643c1b5bbe83a5c6d975467dabd6027ff48d0c9d0cd06ecdbf6b6a5f97a060e0353eb31898d66a9e1adcc5497e05bac06566f27
-
Filesize
722B
MD59905f1007510a4eea8ff5dea0fbbd5d7
SHA1ea45884fd8709bb69a08079e0b51a2627f225098
SHA256d86913a0c2c0618fa501d1055f177868c8eead8b04846b4d9a5645313c099559
SHA512fdf4b075d8e6edf68e713084ebc972eb0edb2588212687fe9bb0e56b09f33169438bcb4890999419022c8ba14eeb2db6dd363999c70f0898a6e2376ccdd21c08
-
C:\Users\Admin\AppData\Local\Temp\512cd8104a96191216e2316b00a729b9e9cfd0191551d39fcd4944080d2670c3.exe.exe
Filesize41KB
MD5977e405c109268909fd24a94cc23d4f0
SHA1af5d032c2b6caa2164cf298e95b09060665c4188
SHA256cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f
SHA51212b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5
-
Filesize
29KB
MD55b4c3134de39fdc610b472ca6e113242
SHA17941f97bab57022193bad8718a864b72c55eefc9
SHA256cd8cbf6357454d633657c471e6ef57a5cbeadb7df75d37d8ebe93e0097967a6c
SHA512717ba94652d293686833b1f4a759826d54cac51498fabbfaff240c1c9959d9deea38f277537c604d21ad70e8237fec0cf769bb5adcb4bc52e5ade69efbddab86
-
Filesize
9B
MD51368e4d784ef82633de86fa6bc6e37f9
SHA177c7384e886b27647bb4f2fd364e7947e7b6abc6
SHA25657507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772
SHA5123cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b