Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
Resource
win10v2004-20240802-en
General
-
Target
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe
-
Size
364KB
-
MD5
25dd2deac477c00307be4e35fe36d16a
-
SHA1
6cbf31d3f76282c7bebf245608cf52857fbe4b0d
-
SHA256
fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40
-
SHA512
e5a545859036dd3617cfc013d72e4d267d3a9c4e303d0fa7c7010c34b0e97266c88549f3f0e2a0de4aa1194be21927084571cd8492dd0258227107aef40ee69f
-
SSDEEP
6144:tCuJPzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:1U66b5zhVymA/XSRh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2300 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2116 Logo1_.exe 2704 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe -
Loads dropped DLL 1 IoCs
pid Process 2300 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe 2116 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2300 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 30 PID 2900 wrote to memory of 2300 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 30 PID 2900 wrote to memory of 2300 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 30 PID 2900 wrote to memory of 2300 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 30 PID 2900 wrote to memory of 2116 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 31 PID 2900 wrote to memory of 2116 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 31 PID 2900 wrote to memory of 2116 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 31 PID 2900 wrote to memory of 2116 2900 fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe 31 PID 2116 wrote to memory of 2492 2116 Logo1_.exe 33 PID 2116 wrote to memory of 2492 2116 Logo1_.exe 33 PID 2116 wrote to memory of 2492 2116 Logo1_.exe 33 PID 2116 wrote to memory of 2492 2116 Logo1_.exe 33 PID 2300 wrote to memory of 2704 2300 cmd.exe 35 PID 2300 wrote to memory of 2704 2300 cmd.exe 35 PID 2300 wrote to memory of 2704 2300 cmd.exe 35 PID 2300 wrote to memory of 2704 2300 cmd.exe 35 PID 2492 wrote to memory of 2716 2492 net.exe 36 PID 2492 wrote to memory of 2716 2492 net.exe 36 PID 2492 wrote to memory of 2716 2492 net.exe 36 PID 2492 wrote to memory of 2716 2492 net.exe 36 PID 2116 wrote to memory of 1208 2116 Logo1_.exe 21 PID 2116 wrote to memory of 1208 2116 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aC513.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe"4⤵
- Executes dropped EXE
PID:2704
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2716
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD513ab6f992499a26f664246ba9e6aa42b
SHA16f66a0e0c2a6b0c4d8ce6cae440390ec57b4122f
SHA256674a8940e5dedbcbd1ef3cb161df118cc5341fad90c8f0932e1da0894e363588
SHA512ee0702bc750ba4af65155435202aa2a2b411df32c4ad9216489dd85b645cb5113b1a9ad08a70af3eb0e94c889dc508caf251a53b9240aa79c66ae116226be886
-
Filesize
474KB
MD56eabc463f8025a7e6e65f38cba22f126
SHA13e430ee5ec01c5509ed750b88d3473e7990dfe95
SHA256cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7
SHA512c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab
-
Filesize
722B
MD5d2d9744d1fb5d4968af8820bca632e24
SHA19ff1d09e39a71c1046759ca1e8427507e68a6d21
SHA256c8daa1a0c41d2fcbc713ab749eeae8421a78809b289db18d4b651f206851917e
SHA512fec6bc4428807682d8472705e78368a91bf8d01c7e3e6780c427708d51c90fefa0deb0958b21b8ff4befbd4324a2cb698866da6ec410fe0d3abcbc89fd686cec
-
C:\Users\Admin\AppData\Local\Temp\fc92f1389ff0310b0eaa65b44c55129947c857f036ec724d779663019ef8ff40.exe.exe
Filesize335KB
MD540ac62c087648ccc2c58dae066d34c98
SHA10e87efb6ddfe59e534ea9e829cad35be8563e5f7
SHA256482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
SHA5120c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
-
Filesize
29KB
MD5c64b5702b462a9345363255cd38a3788
SHA19b6b6e857e544e61ee783065926c92d48337f0ce
SHA25616c685475090f9e09f57bb8836c127fb02a08926f76779de941fad5d6305f825
SHA51226c0c862561e1521891ee018bec7e128578343b2bc0e3471b87c5ef536e235c7ac9665c3ba84f9e0b9b206d3fae859ebefb1fd373123e0ee31b670e9bbe73836
-
Filesize
8B
MD5fcbaf0a2c3988ef775359f94d545ab42
SHA1174ccd98ff87b8e6f46eebc493f379beafeb3b08
SHA256895aaa8dac57f2bb76ddc8c2681e0480bf57dbf3f62cda3840cb448b8615612f
SHA5127c81b6445708b1c482599bfb808e90462d6111e885691dd947d9cdf95ba028d580b20027575814a310a81f310261b649792b65153ce43063da063b5005561d20