Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 03:47

General

  • Target

    32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714N.exe

  • Size

    63KB

  • MD5

    196a114bb963b6ed3779ebb61af96bc0

  • SHA1

    290d514d7bf18deb2673136e2be99cd18c1c97a6

  • SHA256

    32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714

  • SHA512

    f9f39dc2ef0b19f157f3c3a7b9a978589041da651c4b9550b9a3c81c310b7fb2268051f539823279b99b77275e673d96185122a1e73995dde849d6ec26a44557

  • SSDEEP

    1536:gXtl2WkC3UcetLAwEM/SrhYOEfrMrRI2fM7:gX6WkC3yD/SrhYOEfrM9ICM7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 34 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714N.exe
    "C:\Users\Admin\AppData\Local\Temp\32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714N.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1300
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:5100
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:4164
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    63KB

    MD5

    196a114bb963b6ed3779ebb61af96bc0

    SHA1

    290d514d7bf18deb2673136e2be99cd18c1c97a6

    SHA256

    32ae5a49724b5361da80f79804e3864e007b18723fb507c0466d690fc3e22714

    SHA512

    f9f39dc2ef0b19f157f3c3a7b9a978589041da651c4b9550b9a3c81c310b7fb2268051f539823279b99b77275e673d96185122a1e73995dde849d6ec26a44557

  • memory/1300-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1300-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1300-7-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2764-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-18-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-449-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-81-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-33-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-35-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-36-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-80-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-79-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-40-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-14-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-60-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2764-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/4164-58-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/4164-41-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/4636-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/4636-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/4636-0-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/5100-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/5100-13-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB