Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
218s -
max time network
221s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b8046c6f7c455e0522836655c11a4210.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b8046c6f7c455e0522836655c11a4210.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b8046c6f7c455e0522836655c11a4210.exe
-
Size
66KB
-
MD5
b8046c6f7c455e0522836655c11a4210
-
SHA1
a0361934c8520d77aa3fc39f409c7d0bdba924c1
-
SHA256
294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
-
SHA512
9584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05
-
SSDEEP
1536:KjeDGckFmFrs2xY3ujN1BpUP3KYqzkaml6YAnfVdgGYYCWyxJg1V6sm7:K7ckFSq3uH8P3KYqbmlFAnfVddUk2s+
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3688 urdvxc.exe 2248 urdvxc.exe 3932 urdvxc.exe 5024 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.b8046c6f7c455e0522836655c11a4210.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.b8046c6f7c455e0522836655c11a4210.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\ClearAdd.mhtml urdvxc.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3550B4F4-6206-B67D-745E-43F525C3A974}\LocalServer32 NEAS.b8046c6f7c455e0522836655c11a4210.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3550B4F4-6206-B67D-745E-43F525C3A974}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.b8046c6f7c455e0522836655c11a4210.exe" NEAS.b8046c6f7c455e0522836655c11a4210.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nqkvthkblnnhxvkj" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3550B4F4-6206-B67D-745E-43F525C3A974} NEAS.b8046c6f7c455e0522836655c11a4210.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "xlnjklzsrlrjbqtn" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lhhrcqnssersjzrh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hkvvhkjcezllxwtr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3550B4F4-6206-B67D-745E-43F525C3A974}\ = "bkrtlhlehxjbbhst" NEAS.b8046c6f7c455e0522836655c11a4210.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3688 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3712 wrote to memory of 3688 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 88 PID 3712 wrote to memory of 3688 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 88 PID 3712 wrote to memory of 3688 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 88 PID 3712 wrote to memory of 2248 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 89 PID 3712 wrote to memory of 2248 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 89 PID 3712 wrote to memory of 2248 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 89 PID 3712 wrote to memory of 5024 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 92 PID 3712 wrote to memory of 5024 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 92 PID 3712 wrote to memory of 5024 3712 NEAS.b8046c6f7c455e0522836655c11a4210.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b8046c6f7c455e0522836655c11a4210.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b8046c6f7c455e0522836655c11a4210.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:2248
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.b8046c6f7c455e0522836655c11a4210.exe2⤵
- Executes dropped EXE
- Modifies registry class
PID:5024
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5b8046c6f7c455e0522836655c11a4210
SHA1a0361934c8520d77aa3fc39f409c7d0bdba924c1
SHA256294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
SHA5129584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05
-
Filesize
66KB
MD5b8046c6f7c455e0522836655c11a4210
SHA1a0361934c8520d77aa3fc39f409c7d0bdba924c1
SHA256294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
SHA5129584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05
-
Filesize
66KB
MD5b8046c6f7c455e0522836655c11a4210
SHA1a0361934c8520d77aa3fc39f409c7d0bdba924c1
SHA256294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
SHA5129584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05
-
Filesize
66KB
MD5b8046c6f7c455e0522836655c11a4210
SHA1a0361934c8520d77aa3fc39f409c7d0bdba924c1
SHA256294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
SHA5129584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05
-
Filesize
66KB
MD5b8046c6f7c455e0522836655c11a4210
SHA1a0361934c8520d77aa3fc39f409c7d0bdba924c1
SHA256294f0fd6fd9b25e2dd7c45f1b88a7ba499cf9a4b10e9aef8f1615221add324c8
SHA5129584573d828b2986c44b2752707e23e58594e6fbc0b282fba414404196d9f2f2ece83ef85b74ae631f8463824e47858eb19132ca2710ddfbb13d066cc9ce8c05