Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2b684f6f077f9bd146822a982ad83690.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2b684f6f077f9bd146822a982ad83690.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2b684f6f077f9bd146822a982ad83690.exe
-
Size
119KB
-
MD5
2b684f6f077f9bd146822a982ad83690
-
SHA1
9a2f485b0d9288042ccead8fc5f7c3a02fff38b5
-
SHA256
88a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
-
SHA512
db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376
-
SSDEEP
1536:pS55rsva9w4xCRM5h4SCwqisBaDpmXsYfyRn7+kiW7BhiDjtHGWFPPEvKQNTxzbs:wfUAHHpqisBOgXcR7+ktBK5mmDQNVzbs
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2396 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 1448 urdvxc.exe 3772 urdvxc.exe 1032 urdvxc.exe 2396 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.2b684f6f077f9bd146822a982ad83690.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.2b684f6f077f9bd146822a982ad83690.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75D3D750-4E19-D11A-A32E-7A144F288728}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.2b684f6f077f9bd146822a982ad83690.exe" NEAS.2b684f6f077f9bd146822a982ad83690.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kbeshjeenbrsnjth" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "ezkqehkjbskbbvec" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75D3D750-4E19-D11A-A32E-7A144F288728}\ = "rskttxcqrllxhcrs" NEAS.2b684f6f077f9bd146822a982ad83690.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ebtnnnrnnxntllkz" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75D3D750-4E19-D11A-A32E-7A144F288728}\LocalServer32 NEAS.2b684f6f077f9bd146822a982ad83690.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ewrhnlcshhnkklnb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "bsbqvhjjxcrhnrel" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75D3D750-4E19-D11A-A32E-7A144F288728} NEAS.2b684f6f077f9bd146822a982ad83690.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "qntkssncbkkevjhe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "khlnqjqlbtkjethk" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "lhwenksxnbrrljcr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "xvlkwbnsrkqsntqv" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1448 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1448 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 91 PID 1144 wrote to memory of 1448 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 91 PID 1144 wrote to memory of 1448 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 91 PID 1144 wrote to memory of 3772 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 92 PID 1144 wrote to memory of 3772 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 92 PID 1144 wrote to memory of 3772 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 92 PID 1144 wrote to memory of 2396 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 94 PID 1144 wrote to memory of 2396 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 94 PID 1144 wrote to memory of 2396 1144 NEAS.2b684f6f077f9bd146822a982ad83690.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2b684f6f077f9bd146822a982ad83690.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2b684f6f077f9bd146822a982ad83690.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:3772
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.2b684f6f077f9bd146822a982ad83690.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:2396
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD52b684f6f077f9bd146822a982ad83690
SHA19a2f485b0d9288042ccead8fc5f7c3a02fff38b5
SHA25688a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
SHA512db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376
-
Filesize
119KB
MD52b684f6f077f9bd146822a982ad83690
SHA19a2f485b0d9288042ccead8fc5f7c3a02fff38b5
SHA25688a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
SHA512db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376
-
Filesize
119KB
MD52b684f6f077f9bd146822a982ad83690
SHA19a2f485b0d9288042ccead8fc5f7c3a02fff38b5
SHA25688a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
SHA512db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376
-
Filesize
119KB
MD52b684f6f077f9bd146822a982ad83690
SHA19a2f485b0d9288042ccead8fc5f7c3a02fff38b5
SHA25688a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
SHA512db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376
-
Filesize
119KB
MD52b684f6f077f9bd146822a982ad83690
SHA19a2f485b0d9288042ccead8fc5f7c3a02fff38b5
SHA25688a07b46bd2ec98ca7ce694946b1e1b96fa69c8ea6251b8e23362590bc910564
SHA512db9ec563a0752dc9833ac75be87c5e4f41d57d0b7687cb172e1902cf08b7098c5e48f3f56a2489b2bab2886902781ec3ab00ff0d3d51f156d92b108c17807376