Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe
Resource
win10v2004-20220901-en
General
-
Target
c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe
-
Size
84KB
-
MD5
07321afeeceb1025a660a6c1a06a2641
-
SHA1
380a6c8abf0de4de5f194719ee16e7ee20007b3a
-
SHA256
c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
-
SHA512
cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
SSDEEP
1536:TA8CQ7xAGDeCCVENYtmqotwuE0/8SZ1PtjUmAZy+cWAEGQvrCpq/FgbmmcXpVcDW:8Bvv28ShjwHQQWqFuc5VcDJvo
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4400 urdvxc.exe 3500 urdvxc.exe 1792 urdvxc.exe 1480 urdvxc.exe 2700 urdvxc.exe 5008 urdvxc.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\sekbhrbe.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\ExportUnlock.html urdvxc.exe File opened for modification C:\Program Files\ExportUnlock.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html urdvxc.exe File opened for modification C:\Program Files\ExportUnlock.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\nsstljje.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lbvjssvknlhbtenn" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "xejxrznekkkjebbb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91426C6C-7E94-4BB5-7E3B-C2FEEBE81F09}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe" c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rkrewejtcbszbtsk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "zezlhnssbehexhbk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91426C6C-7E94-4BB5-7E3B-C2FEEBE81F09}\ = "jkelvvshrrwxsjll" c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91426C6C-7E94-4BB5-7E3B-C2FEEBE81F09}\LocalServer32 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "vjbltweeslttllkt" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91426C6C-7E94-4BB5-7E3B-C2FEEBE81F09} c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\\nsstljje.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "knjllzwxjerjtjlk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "henstkjjwlnvxjjh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jwlcknschkrjzrlt" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lsjljsecqkcbwlqr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4400 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4400 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 85 PID 4816 wrote to memory of 4400 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 85 PID 4816 wrote to memory of 4400 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 85 PID 4816 wrote to memory of 3500 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 86 PID 4816 wrote to memory of 3500 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 86 PID 4816 wrote to memory of 3500 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 86 PID 4816 wrote to memory of 1480 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 90 PID 4816 wrote to memory of 1480 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 90 PID 4816 wrote to memory of 1480 4816 c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe"C:\Users\Admin\AppData\Local\Temp\c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:3500
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411.exe2⤵
- Executes dropped EXE
- Modifies registry class
PID:1480
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1792
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2700
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\SysWOW64\urdvxc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:5008
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012B
MD5661986eb37cc9cfc2f17614e81d71a6d
SHA16f5a8828691bfabda2656ba5435c39db61933cba
SHA2565edb9dd67373164b6d5297e4fad9846c712451a74f8a8a965c39c61c19646a03
SHA51211da83092eebe57cc2493d37f480bf706880883a1c4c7af910fe1e2d1fa3c923b7f6cca99d8bfc61255879ef146af94b0925cc07ca53c431b4ef1f24d36e970e
-
Filesize
1KB
MD57ef08a7e40d580174c363e0dd3bbbfd7
SHA188bf70dd3770dd6dbc3629bd0c6ae79898844dcf
SHA256809d281fdc0219c9fce3194ec7d22b9a2f41f9e7afe5089b908561ae6466b724
SHA5125190ae023f2bf3fb351ef7de3a14e740e493aa971fdf14680747d9f635eedf0ecce861174da1765f7263e2a896d83ab76dd5c0208ab899ce34831511cf4e2dac
-
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html
Filesize1KB
MD57915168e1915f03c8db93427bb9362af
SHA19cca121c448a9a38f815653014da4bd9f323596c
SHA256b9b7298e796bee7942b808d120c1da2f40508b719d0f57c792f6898963036ae7
SHA512fbae43dc5b5c1ececfcde9a92abe7caf8848b8a3d2d3a2663490bec65afbfcd0ecd2e6059e34fdc3af07c206deb45c9b3e4b85776e87ff7e19d96ee756fe843a
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae
-
Filesize
84KB
MD507321afeeceb1025a660a6c1a06a2641
SHA1380a6c8abf0de4de5f194719ee16e7ee20007b3a
SHA256c12c2322f3a170b5823ef819994cb659b2c09d1698e19d597c3acd9765267411
SHA512cdf9c1f26eae5c3a03a1ac1cb5e3668a99ed25b671db401af0d92e3df9a6df90b14d5ac08f6ecbae62befdccb3323d97fad4a8e5d6e7ef6b41af2d3d7473f5ae