Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe
Resource
win10v2004-20240802-en
General
-
Target
6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe
-
Size
247KB
-
MD5
15b12da781d4e8b1b5c1436a290819ec
-
SHA1
33df21ba8a9213e5ef6ebbbb47248ec01c6fae22
-
SHA256
6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621
-
SHA512
2052cddf85dbd1d57710b16872a1dd86702b20f95d1ff7ef49bcfacf2b06b0017e26cddc5f9cce42e7de7863c4b33a8ac624ac55fe881f585ccffe39057b3188
-
SSDEEP
6144:CuJWqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:/ml5a6EdkQgUmR7G9QK3wJx+qSfF0
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2288 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2332 Logo1_.exe 2780 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe -
Loads dropped DLL 1 IoCs
pid Process 2288 cmd.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe Logo1_.exe File created C:\Program Files\Windows Mail\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{FC37790F-E395-416A-A1A1-53BC987E89B4}\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre7\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe File created C:\Windows\Logo1_.exe 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe 2332 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2288 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 31 PID 2256 wrote to memory of 2288 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 31 PID 2256 wrote to memory of 2288 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 31 PID 2256 wrote to memory of 2288 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 31 PID 2256 wrote to memory of 2332 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 32 PID 2256 wrote to memory of 2332 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 32 PID 2256 wrote to memory of 2332 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 32 PID 2256 wrote to memory of 2332 2256 6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe 32 PID 2332 wrote to memory of 2264 2332 Logo1_.exe 34 PID 2332 wrote to memory of 2264 2332 Logo1_.exe 34 PID 2332 wrote to memory of 2264 2332 Logo1_.exe 34 PID 2332 wrote to memory of 2264 2332 Logo1_.exe 34 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2288 wrote to memory of 2780 2288 cmd.exe 37 PID 2264 wrote to memory of 2752 2264 net.exe 36 PID 2264 wrote to memory of 2752 2264 net.exe 36 PID 2264 wrote to memory of 2752 2264 net.exe 36 PID 2264 wrote to memory of 2752 2264 net.exe 36 PID 2332 wrote to memory of 1268 2332 Logo1_.exe 21 PID 2332 wrote to memory of 1268 2332 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe"C:\Users\Admin\AppData\Local\Temp\6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe"C:\Users\Admin\AppData\Local\Temp\6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
474KB
MD517e5de36cf448d652adab881a4557ec2
SHA1c45337444120f4cc4a9a65b2bee63cd61618ca2a
SHA25632568fb07078e0d4e77efac9ad862454dba63de5c5f920d9a14de709372f2430
SHA51222678c9ca2d70d9a3377d1f2c6c91d7649adcaccee564acdf1bd6373e60f13f6e21fc09feed5b590475889996287961a1450542741ef0888a4a0b5e9c9812b92
-
Filesize
722B
MD58e699f2e71f9bb0086510fdb8995e7ea
SHA1fb80a7de2b55a408d975dbdbe1336cb7e9cb7b82
SHA2564486adfdb4301157b7e8f1ef5a4062f64cb4295ba3f8c049d3e479d7f1ed675b
SHA51206b9d1563fe034cfc014441ba76580fc352fdce1044635683f9ce9615e67c315e04cf2f2a699452b86e0607b381a4e7d049f6608381ebd49eed98f233cbcbde0
-
C:\Users\Admin\AppData\Local\Temp\6c6e9a1fc4ddd52db20020fe31a673179cb8338e61930dbacd8132a626aa0621.exe.exe
Filesize217KB
MD5021c57c74de40f7c3b4fcf58a54d3649
SHA1ef363ab45b6fe3dd5b768655adc4188aadf6b6fd
SHA25604adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef
SHA51277e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018
-
Filesize
29KB
MD5d86e4e8dd72464850871a0ffe047ec47
SHA16f8cd1a4120e750c324c4691f6705089ac6d702c
SHA25674bed47cfee84b7ac715ab7795abb93f0bc661178bc030c2c2209443ddc57300
SHA5123d6438fad37c0f2c7c7f46aa1eb79e66897631d5c43781d71707cfa5679f37afb856d84736dd0f1b20333756e178dc51324a243824081ca87bff34c688ba1bf8
-
Filesize
9B
MD5f74f4ac317419affe59fa4d389dd7e7c
SHA1010f494382d5a64298702fe3732c9b96f438c653
SHA25674fafb0f14fb17a8a4963d5f46fc50b3517e7aa13414ac5f42edfdf212a9bb01
SHA512f82fea1632b97d2b6771f43a6941c84d7fbb86f4c4f69e9b4335aa0e166e2670f09d451da61b13cb16994b9294e99b1cfa27f2447579645b3886b7bd014cc00f