Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe
Resource
win10v2004-20240802-en
General
-
Target
c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe
-
Size
52KB
-
MD5
6c41d1c20a510cf9e830f0e20be6b195
-
SHA1
264b5e0f57d3d14d81881b923012856a97a00e59
-
SHA256
c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3
-
SHA512
1c75cbfeeca34c05f2252303584781a4776341c61c846ab466390256fed156ed5de49a34f9e4a995075244501e4015c2a19b8e79adcc29de7c8d4f21770aac03
-
SSDEEP
768:pC16GVRu1yK9fMnJG2V9dHS85qgt6jpYU5ltbDrYiI0oPxWExI:pE3SHuJV9NP6jWWvr78Pxc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2596 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1424 Logo1_.exe 2648 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe -
Loads dropped DLL 5 IoCs
pid Process 2596 cmd.exe 2524 WerFault.exe 2524 WerFault.exe 2524 WerFault.exe 2524 WerFault.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe File created C:\Windows\Logo1_.exe c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe 1424 Logo1_.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2596 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 31 PID 2060 wrote to memory of 2596 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 31 PID 2060 wrote to memory of 2596 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 31 PID 2060 wrote to memory of 2596 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 31 PID 2060 wrote to memory of 1424 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 32 PID 2060 wrote to memory of 1424 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 32 PID 2060 wrote to memory of 1424 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 32 PID 2060 wrote to memory of 1424 2060 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 32 PID 2596 wrote to memory of 2648 2596 cmd.exe 35 PID 2596 wrote to memory of 2648 2596 cmd.exe 35 PID 2596 wrote to memory of 2648 2596 cmd.exe 35 PID 2596 wrote to memory of 2648 2596 cmd.exe 35 PID 1424 wrote to memory of 2624 1424 Logo1_.exe 34 PID 1424 wrote to memory of 2624 1424 Logo1_.exe 34 PID 1424 wrote to memory of 2624 1424 Logo1_.exe 34 PID 1424 wrote to memory of 2624 1424 Logo1_.exe 34 PID 2648 wrote to memory of 2524 2648 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 38 PID 2648 wrote to memory of 2524 2648 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 38 PID 2648 wrote to memory of 2524 2648 c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe 38 PID 2624 wrote to memory of 2708 2624 net.exe 37 PID 2624 wrote to memory of 2708 2624 net.exe 37 PID 2624 wrote to memory of 2708 2624 net.exe 37 PID 2624 wrote to memory of 2708 2624 net.exe 37 PID 1424 wrote to memory of 1208 1424 Logo1_.exe 21 PID 1424 wrote to memory of 1208 1424 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe"C:\Users\Admin\AppData\Local\Temp\c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aE917.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe"C:\Users\Admin\AppData\Local\Temp\c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2648 -s 1245⤵
- Loads dropped DLL
PID:2524
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD53ca1bf22fc4c86f1ffd00a866ab6ff39
SHA1059063c11ade4cafeb9eea49592aa4a049ee9269
SHA2561123254ef1434c7002e054e89afbbb5a47cba9aff92916c03203e3dff7704220
SHA5125ff6e33ff4e45571b0684ddc95e4ffaf8260151b2fcd2ae9be2bd72be27ee8e8364e2185e1df5f1019e9d9d937b757bcd538483ca12d0eca6cc7f36bd88d81b0
-
Filesize
474KB
MD56eabc463f8025a7e6e65f38cba22f126
SHA13e430ee5ec01c5509ed750b88d3473e7990dfe95
SHA256cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7
SHA512c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab
-
Filesize
722B
MD504462c803b406942d19d18c7a99432d1
SHA14ed73382a6d4467279b3a815194bdc6e24054f23
SHA256ee43f485c00a5f383ed1cad232dabdf6bfe215828597d18b7485d34aee6f03a5
SHA51254e1c2790639a9134167119f9f4829e2a3d5522811a6cf75259c260ba1ccc82972ff91218d422b04a78f0bb143bdc7987aa6b4da4a8f0049fe28cb8b3f832f66
-
C:\Users\Admin\AppData\Local\Temp\c363c89bd36d03d2af293795deeb7ab37f523ed6fb3470c1da64ee0fbeeeffd3.exe.exe
Filesize23KB
MD53f9dbfee668294872ef01b90740b01d0
SHA199a4702b65485cd14736b1c2cdfb81b455dda01c
SHA25640b32fea1fcadcb2db369475e2bba58b0b83f5c3bb647e2e63877726c35a9f86
SHA5120113cec160d97ea0cce70860cc5b79b502d16191ee237a3abb84309499be193aa0127dbcb41fc05a90fa61484b061ec4332ad29a918db598e32fe832b74bd1e3
-
Filesize
29KB
MD58e134732e471b77cbaecf5d11f8d6949
SHA162db8b6ef2f8ff0893f692fd3fd36d704fc43c67
SHA2560f65cfb0d4c3fda3b0c30629eee04caa0341dcb465a585c07f9f43652bd9bc71
SHA51230e7ebf198886879a59515016dbc5c752594b18e27de067871a17dacdb478cfc02327e77e8a699c292fa8620c7ca4af230d37d76ed92621c3807c882ba42f6bc
-
Filesize
9B
MD5475984718232cf008bb73666d834f1f4
SHA112f23c9301c222f599a279e02a811d274d0f4abc
SHA256a5b32591119f87eb3c8a00c0c39e26ea6d6414aa9887d85fcb4903e1c14921b5
SHA51280235dc2560b7991d79f9550cdeca6ac02c00cee6bf186f8f20d4ff3fbd7718be937b73ab768d71c4027e153557b08bbfd95ea88d2e0857a7c70cf1da6fa9937