Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
Resource
win10v2004-20240709-en
General
-
Target
bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe
-
Size
398KB
-
MD5
ca4eef83512d0a2704a0146c7dcc8a92
-
SHA1
bb6b28582da7a1661fdbb0ec026b2c2919fd84ba
-
SHA256
bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7
-
SHA512
362457b3a2d89015ec34a181af95442eed8eb43ff6ebe4e8b66a38c36c01991af62c84b7494c936d85cf031548e5ae1aafba55ea8b67a8955aabea64c20e2372
-
SSDEEP
12288:x7+iY+evpFV5DJhzAtUskJ0eZHQ2ksAKNeiQ30blG:x76HVnkszNerEk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1792 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2236 Logo1_.exe 2748 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe -
Loads dropped DLL 2 IoCs
pid Process 1792 cmd.exe 1792 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Mail\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\More Games\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DAO\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\fr-FR\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe File created C:\Windows\Logo1_.exe bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe 2236 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1792 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 30 PID 2544 wrote to memory of 1792 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 30 PID 2544 wrote to memory of 1792 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 30 PID 2544 wrote to memory of 1792 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 30 PID 2544 wrote to memory of 2236 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 31 PID 2544 wrote to memory of 2236 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 31 PID 2544 wrote to memory of 2236 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 31 PID 2544 wrote to memory of 2236 2544 bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe 31 PID 2236 wrote to memory of 2756 2236 Logo1_.exe 33 PID 2236 wrote to memory of 2756 2236 Logo1_.exe 33 PID 2236 wrote to memory of 2756 2236 Logo1_.exe 33 PID 2236 wrote to memory of 2756 2236 Logo1_.exe 33 PID 2756 wrote to memory of 2768 2756 net.exe 35 PID 2756 wrote to memory of 2768 2756 net.exe 35 PID 2756 wrote to memory of 2768 2756 net.exe 35 PID 2756 wrote to memory of 2768 2756 net.exe 35 PID 1792 wrote to memory of 2748 1792 cmd.exe 36 PID 1792 wrote to memory of 2748 1792 cmd.exe 36 PID 1792 wrote to memory of 2748 1792 cmd.exe 36 PID 1792 wrote to memory of 2748 1792 cmd.exe 36 PID 2236 wrote to memory of 1188 2236 Logo1_.exe 21 PID 2236 wrote to memory of 1188 2236 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a98F5.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD53f9d951f006c9e4eb9951ce307b1154b
SHA1b28c6e9e4d8fe8ff3c5c386d7046f1c1287f6d56
SHA2561c3c896c3005c00cca13630a5e1c42da1f486be098cf7b24bf04b91c1285c564
SHA51211e163e794a3542b98a5e8cb7903dbd5880f79a812502319f07a279ac3a6bb3cce5d20b6e32dbce81e290c0a0d57ad085a2db80622677c3827324fb7c9c987ee
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD576d472f2865dc5d2630ba885b69ab814
SHA165930959cd7edd96c994d28c59b6bbbd384d1732
SHA256db4f98c17423b6915c16b63ca9560709acdfbcd69027cbf0f1bb40efda2f77bd
SHA5126aefe1636d56c4966a755400383ca59d75cc50e13ffd46c89b8767b44efcfca2db7b256cf6724f6f957075a85ffe6542712c43f7a03172a11f5fbcc536f671c1
-
C:\Users\Admin\AppData\Local\Temp\bdc3eee5d021b20f8def7ff2bf0355daf38dded2aefa3fd8250401d11613b8f7.exe.exe
Filesize372KB
MD56da7293f38e94cb996573701b304c023
SHA11138423f6c20051813861da57dbd1d801d45a1a9
SHA256e08a1fd51eb282da8bb1d62f441b9dc1c908dfe48681a53340b0bf4dab2dcd7a
SHA5124642994096d39f226ffa5c9a5d53b8b82fdf507dffe2f23573e4c96b76d5893416e7741245f43cb96e2f1e59b0829b2b81c5bb19caefd1bb3de49ec4821fe407
-
Filesize
26KB
MD5299f200b35bb4d4b2806d2126f9adaf0
SHA1d79612590eabd0b56be89ac3df76ff2070e44681
SHA2566f659314234895b3f36d86958d115025e5151bb5f3eb05a7c86a91aa15a3fa82
SHA5125c40e2692cbe3b33f27d8281a4fc5d1069de84964cdae28d6986145e39d66be9751eee147874ab359768e3d33a58053b4ef8ff90fb63326131555d8c3ae58eb8
-
Filesize
9B
MD526a799e5457b5e8836d7b58e5787f437
SHA17dc33652947afbe41d930e2a928dbd2f2e23e983
SHA256a6038a34fb7a4cafee0fabca96d108d7ffbb35832abfa12290467dea3360e00f
SHA51203d1a024d878a4021e38dfda03c8b8941640dd7f580a85b9045c1b421df3c32925d1bd9d3818983eb4987a6ac18fb88d368f7f712a9095a089657299c233095e