Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe
-
Size
66KB
-
MD5
e376b7e8169f69b27cb6987bd805ccf0
-
SHA1
75dccfa0200a5793913c63d8bea72338e2cae086
-
SHA256
e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
-
SHA512
1e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
SSDEEP
1536:PfeQsWclEPLu9sGS0ktEUzLrb1wTjO//Cypnwqd6bK/fl/BPsT:Pfe75sGSptJjbZ/KSwC6bWVBPsT
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 496 urdvxc.exe -
Executes dropped EXE 5 IoCs
pid Process 784 urdvxc.exe 2216 urdvxc.exe 404 urdvxc.exe 496 urdvxc.exe 552 urdvxc.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe urdvxc.exe File opened for modification C:\Program Files\GroupProtect.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "twsqlhlcbnrqtrcb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "twhsknwnssrxlret" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "hjbzjrsbcrthzbtc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ntlntkjjbettjnct" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tcjqrtshrbxjhelj" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2DC9E2B-6DFC-86A3-0EB3-AD69DBDCB737}\LocalServer32 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rvrxhhbxnhcnletn" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "qcrhnnernbreetkh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2DC9E2B-6DFC-86A3-0EB3-AD69DBDCB737} NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "hzktrezbvctljvlk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "whzwrsnxtchlbtjr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qsvhltrcnhlkhktw" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nexbskjhheztvhjx" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2DC9E2B-6DFC-86A3-0EB3-AD69DBDCB737}\ = "qhxnshlnqwnqebtj" NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2DC9E2B-6DFC-86A3-0EB3-AD69DBDCB737}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe" NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 784 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3500 wrote to memory of 784 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 87 PID 3500 wrote to memory of 784 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 87 PID 3500 wrote to memory of 784 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 87 PID 3500 wrote to memory of 2216 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 88 PID 3500 wrote to memory of 2216 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 88 PID 3500 wrote to memory of 2216 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 88 PID 3500 wrote to memory of 496 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 90 PID 3500 wrote to memory of 496 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 90 PID 3500 wrote to memory of 496 3500 NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:2216
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.e376b7e8169f69b27cb6987bd805ccf0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:496
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:404
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:552
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0
-
Filesize
66KB
MD5e376b7e8169f69b27cb6987bd805ccf0
SHA175dccfa0200a5793913c63d8bea72338e2cae086
SHA256e5d6ac842a791d3dce4b56ffb2a89c8fe7c9d2f175751bff3d2d8de4167b9d7e
SHA5121e29db124311cd111f187706389b1c54e921980477515862f6e418eb3dbfeb87f978ed06cca4f7ee0211527c25d4a196980c85ba30dd8d344ca75ca3262e35b0