Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 01:39

General

  • Target

    c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe

  • Size

    119KB

  • MD5

    c1a23d40f56e4154e87d503f81e7f850

  • SHA1

    1f61b3944cc99ff5fb03924d4dd3a0b5b23927d1

  • SHA256

    bfab6baa1b63096bac246652ee6bddaa19672c99600cd4251d107a16d63b7db6

  • SHA512

    4aac7421f2cae51f56419dd30a9ba076f8de6aa61bc31ab9552930ed834de75bab4c56c932f2a1a2d5a1022f63eaaf0bd3a1fabf499c737d02353115451aba49

  • SSDEEP

    3072:F/fF5/ybRxbVlD7fShaPDXaJ8OyBQceZ9PW4w:ZfF5/ybRpDtnOyBF+9W4w

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3452
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:3304
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:4964
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4184
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk-1.8\README.html

    Filesize

    263B

    MD5

    8e0789ff750b413c70a9b109432cf0ba

    SHA1

    84c429f3b741a44bced2a137ee62254348e89da6

    SHA256

    f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1

    SHA512

    36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899

  • C:\Program Files\Java\jdk-1.8\jre\Welcome.html

    Filesize

    1KB

    MD5

    2fe21944034eb6b2b24f4bed8b1bee2c

    SHA1

    b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1

    SHA256

    6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e

    SHA512

    4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb

  • C:\Program Files\Java\jre-1.8\Welcome.html

    Filesize

    1KB

    MD5

    74f13c185956384b11539babc72982c9

    SHA1

    51cac9d61127f9340f81798ea4d084fb242f5c24

    SHA256

    f0c4d208aba36b21dda722b40bea5b38e0c2e32e7beb2964bf31bca7ea778585

    SHA512

    85b54d801cd804b63e43f26e9ae2de01dccf4c4d8917a8645f17c3767e9458847f45117716073af9e0a53a5b23d25227196b159d9f17a0e7450f46aa03641d46

  • C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html

    Filesize

    1KB

    MD5

    75887f366667b2254dfd35014d4eb318

    SHA1

    03127bc21514e315f8c370a9ac5dbd1cd9e766e7

    SHA256

    fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9

    SHA512

    953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM

    Filesize

    11KB

    MD5

    4c7125f69cf2046a45daeac49cb0019f

    SHA1

    b4b17fbe1091003ed480f40654f22c89c763f01b

    SHA256

    1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d

    SHA512

    ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    c1a23d40f56e4154e87d503f81e7f850

    SHA1

    1f61b3944cc99ff5fb03924d4dd3a0b5b23927d1

    SHA256

    bfab6baa1b63096bac246652ee6bddaa19672c99600cd4251d107a16d63b7db6

    SHA512

    4aac7421f2cae51f56419dd30a9ba076f8de6aa61bc31ab9552930ed834de75bab4c56c932f2a1a2d5a1022f63eaaf0bd3a1fabf499c737d02353115451aba49

  • memory/1140-5967-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/1140-6357-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3252-36-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3252-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3252-0-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/3304-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3304-8-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3452-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/4184-49-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-58-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-23-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-24-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-25-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-26-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-27-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-28-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-29-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-30-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-31-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-32-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-33-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-34-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-35-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-39-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-40-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-41-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-42-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-43-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-45-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-46-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-47-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-48-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-21-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-50-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-51-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-52-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-53-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-54-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-55-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-56-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-57-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-22-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-59-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-60-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-61-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-62-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-63-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-64-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-66-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-67-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-68-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-65-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-69-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-70-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-71-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-72-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-73-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-74-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-75-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-76-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-77-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-78-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-79-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-1293-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-5965-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-20-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-18-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-19-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-17-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-13-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-11-0x0000000000440000-0x000000000045F000-memory.dmp

    Filesize

    124KB

  • memory/4184-10-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/4964-38-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB