Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.024f71da50dfc24cfedbe5ae688f4550.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.024f71da50dfc24cfedbe5ae688f4550.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.024f71da50dfc24cfedbe5ae688f4550.exe
-
Size
119KB
-
MD5
024f71da50dfc24cfedbe5ae688f4550
-
SHA1
bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
-
SHA256
c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
-
SHA512
73e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96
-
SSDEEP
1536:AxAeQJL6GTGiW8+Mcoo+uHZZ44inzEUCG9FvmKe95Z6PI7ivEaf5R+iYINRjiSJn:d7d6GqbMZfu5ZsC4efZ6QbmbRNRGSJQc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3884 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 2244 urdvxc.exe 3456 urdvxc.exe 2072 urdvxc.exe 3884 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe NEAS.024f71da50dfc24cfedbe5ae688f4550.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.024f71da50dfc24cfedbe5ae688f4550.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "tkrttjtlqkwnvbkn" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rwcknwtnctshsesj" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "rwwhqcvbrxttsrkk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "hrhsvtjknrbtvkjb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bxttnqwbsbezjhkq" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "lwjkrvnxjenxbtch" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A404C7D3-D6D7-989A-C2C5-3872FF5B5860}\LocalServer32 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "blsewrjbrljsknbr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kvjtzxvbknhexkzj" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "vvrkhbsqhktjjsse" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A404C7D3-D6D7-989A-C2C5-3872FF5B5860} NEAS.024f71da50dfc24cfedbe5ae688f4550.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A404C7D3-D6D7-989A-C2C5-3872FF5B5860}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.024f71da50dfc24cfedbe5ae688f4550.exe" NEAS.024f71da50dfc24cfedbe5ae688f4550.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A404C7D3-D6D7-989A-C2C5-3872FF5B5860}\ = "klzkzksjkhnhlerj" NEAS.024f71da50dfc24cfedbe5ae688f4550.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2244 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3780 wrote to memory of 2244 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 91 PID 3780 wrote to memory of 2244 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 91 PID 3780 wrote to memory of 2244 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 91 PID 3780 wrote to memory of 3456 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 92 PID 3780 wrote to memory of 3456 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 92 PID 3780 wrote to memory of 3456 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 92 PID 3780 wrote to memory of 3884 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 94 PID 3780 wrote to memory of 3884 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 94 PID 3780 wrote to memory of 3884 3780 NEAS.024f71da50dfc24cfedbe5ae688f4550.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.024f71da50dfc24cfedbe5ae688f4550.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.024f71da50dfc24cfedbe5ae688f4550.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:3456
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.024f71da50dfc24cfedbe5ae688f4550.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:3884
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2072
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD5024f71da50dfc24cfedbe5ae688f4550
SHA1bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
SHA256c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
SHA51273e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96
-
Filesize
119KB
MD5024f71da50dfc24cfedbe5ae688f4550
SHA1bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
SHA256c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
SHA51273e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96
-
Filesize
119KB
MD5024f71da50dfc24cfedbe5ae688f4550
SHA1bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
SHA256c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
SHA51273e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96
-
Filesize
119KB
MD5024f71da50dfc24cfedbe5ae688f4550
SHA1bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
SHA256c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
SHA51273e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96
-
Filesize
119KB
MD5024f71da50dfc24cfedbe5ae688f4550
SHA1bf3c5fd0c290cb0ad9bda5656166eb4936c31eba
SHA256c6429f2df85b1fda061f5bc1d6be716edc96ec9e1153367a29c8f85d8958474f
SHA51273e75089e83f73807ddcb50829abba68bd2fc983cc1fd1072104837b46ba0a5930b340014437d93d60780920eb997d2d07d17dd38ab4473c392d702af56b0f96