Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 15:01

General

  • Target

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd.exe

  • Size

    62KB

  • MD5

    5d1ba4d22d7691c3526bfd816c112671

  • SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

  • SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

  • SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • SSDEEP

    1536:LBWiS7xc8B3oaPttIu6T/9v4yyOcE3VE+pkZJI:VWxa8eaZ6j9vw6Vfps2

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd.exe
    "C:\Users\Admin\AppData\Local\Temp\c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4460
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:4220
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd.exe
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:1284
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    62KB

    MD5

    5d1ba4d22d7691c3526bfd816c112671

    SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

    SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

    SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    62KB

    MD5

    5d1ba4d22d7691c3526bfd816c112671

    SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

    SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

    SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    62KB

    MD5

    5d1ba4d22d7691c3526bfd816c112671

    SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

    SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

    SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    62KB

    MD5

    5d1ba4d22d7691c3526bfd816c112671

    SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

    SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

    SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    62KB

    MD5

    5d1ba4d22d7691c3526bfd816c112671

    SHA1

    3306f6a1d2a43c0019b8496b8621055ca05d87d1

    SHA256

    c1352868c503508eb8d100006dea5c5c1b1d9a27d74a57ecf2af593f0883affd

    SHA512

    2ffd622361b7c7ab5ca42fcceb22d9ea2e92882cc23e633f49536050591c292fa5e40ece322459e25f5c0789cab50da840be4461ada0aeea0d96f0383254e2c8

  • memory/912-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/912-142-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1284-145-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3544-137-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3544-132-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/4220-141-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/4460-136-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB