Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe
Resource
win10v2004-20240802-en
General
-
Target
d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe
-
Size
570KB
-
MD5
9f279f3bb96dcf0bdb72b1a52e723336
-
SHA1
3e209c0396a41a3290c83426f86ae6524861426d
-
SHA256
d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6
-
SHA512
bcc62dd396837318312600afcf425851b77deaf528b1443cded90631f50c612d10d7fd85ea29840e62c38f27dc3d631985ddfd9a286176dffc9353f62c2c5b9d
-
SSDEEP
6144:wsVfjmNCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BE:v7+57a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2368 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2492 Logo1_.exe 2840 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe -
Loads dropped DLL 1 IoCs
pid Process 2368 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Journal\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\server\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe 2492 Logo1_.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2368 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 30 PID 2156 wrote to memory of 2368 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 30 PID 2156 wrote to memory of 2368 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 30 PID 2156 wrote to memory of 2368 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 30 PID 2156 wrote to memory of 2492 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 31 PID 2156 wrote to memory of 2492 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 31 PID 2156 wrote to memory of 2492 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 31 PID 2156 wrote to memory of 2492 2156 d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe 31 PID 2492 wrote to memory of 2148 2492 Logo1_.exe 32 PID 2492 wrote to memory of 2148 2492 Logo1_.exe 32 PID 2492 wrote to memory of 2148 2492 Logo1_.exe 32 PID 2492 wrote to memory of 2148 2492 Logo1_.exe 32 PID 2148 wrote to memory of 2172 2148 net.exe 35 PID 2148 wrote to memory of 2172 2148 net.exe 35 PID 2148 wrote to memory of 2172 2148 net.exe 35 PID 2148 wrote to memory of 2172 2148 net.exe 35 PID 2368 wrote to memory of 2840 2368 cmd.exe 36 PID 2368 wrote to memory of 2840 2368 cmd.exe 36 PID 2368 wrote to memory of 2840 2368 cmd.exe 36 PID 2368 wrote to memory of 2840 2368 cmd.exe 36 PID 2492 wrote to memory of 1196 2492 Logo1_.exe 21 PID 2492 wrote to memory of 1196 2492 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe"C:\Users\Admin\AppData\Local\Temp\d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aA94A.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe"C:\Users\Admin\AppData\Local\Temp\d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe"4⤵
- Executes dropped EXE
PID:2840
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5db63bb344670292cb9d7ef6a65617979
SHA11b1c0a455a634894ed3dbcf325ea9faeda826aff
SHA2561c417b7bbce3b367b46f4593844703683f5ed97e8978c2b45e611b01daca6dab
SHA512a5f6cb76be3c9009dabca649539fe0cc518edcecfedd1f311df7314b99a6d5ee86450bc1fc1ff48383bff6029282f3fc872693fdd3d91ca669f9bee7a0593c8d
-
Filesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
Filesize
722B
MD57f4bf63227e5f26b7c820ee8be54d3ad
SHA1bba9d05ed1066e26f960c0a2ddae72da0b0c362d
SHA2569424f0540df3aa8da63aa7741214f68606e2d53b4d289625f021c6ad50b395cd
SHA512e33db1fd223dc5b36a5c33f739bbdb04c10bc2449c9c7ee85b4e9943cc6c2ba5614e0c96b149681635b9412cea9c5ec12366691f2106fbc3083c5fc41202ea32
-
C:\Users\Admin\AppData\Local\Temp\d48ef1f6ee74dcf82cf81b6ff609f63d754b320efd69ae50714f93c446b911b6.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
26KB
MD5f840b7fc997e1545a0af493debb80730
SHA168d2c2e571748727d05c214028b1de3bea3fce7d
SHA25649a34f007cecef2b47f106a0d40acb46d55602ad1d7bc01e8c0d268cbb6583f5
SHA5122e8c07ec6aefd6194925769847e38b05620efe7249afcdcf24bfe1cdd6e2586efe1cf48ecf4130fe0bdf42fd05aefe8e15fcd23c62897ba7bdf3762fcabd3b72
-
Filesize
8B
MD5646a1be8fae9210cfba53ee1aab14c96
SHA18677ff347131a9c8304f10b48012ebd8b075030c
SHA256660d57a3dc71884e70a9cbd6ca26d02872f4706abeb098c6d35f6b217462edf5
SHA512812b716a422628d486a4c78c66a85c641f13976537fbd452e14fab9a6c440b442632df04de8437c485c9c8164e3b3499201d3dbe681b36fe6bec749df1ab75e4