Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5cdb301d0f8be8c516817c147e792a90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.5cdb301d0f8be8c516817c147e792a90.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5cdb301d0f8be8c516817c147e792a90.exe
-
Size
119KB
-
MD5
5cdb301d0f8be8c516817c147e792a90
-
SHA1
d24c693bb6d7b6c76549210adb276ef9543a273c
-
SHA256
82341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
-
SHA512
6c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0
-
SSDEEP
3072:6Zn/3Hyhcqit0eDaux+H5jLv1nZ0Rkf1lb+m4:iS+tZOwiLj11lg
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2828 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 5036 urdvxc.exe 5096 urdvxc.exe 2552 urdvxc.exe 2828 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.5cdb301d0f8be8c516817c147e792a90.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.5cdb301d0f8be8c516817c147e792a90.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\MeasureGroup.shtml urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D26DA8D-8407-EFB2-0B9E-43C54A981B9E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.5cdb301d0f8be8c516817c147e792a90.exe" NEAS.5cdb301d0f8be8c516817c147e792a90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nbkwnnsjtllqzzzh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D26DA8D-8407-EFB2-0B9E-43C54A981B9E}\LocalServer32 NEAS.5cdb301d0f8be8c516817c147e792a90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wqelzbrjvccjhqrl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D26DA8D-8407-EFB2-0B9E-43C54A981B9E} NEAS.5cdb301d0f8be8c516817c147e792a90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nksrsewvesenrzbb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "lnejzlqrkrsxlkks" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lxlzsbsexlqlrhzv" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "hhsthzzclrqxkhsc" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "eteksnqjznqbrelw" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "sebnsetwqksennzv" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D26DA8D-8407-EFB2-0B9E-43C54A981B9E}\ = "ehekzebcqevlzvnb" NEAS.5cdb301d0f8be8c516817c147e792a90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "netvebnzxktsxjbq" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5036 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2848 wrote to memory of 5036 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 86 PID 2848 wrote to memory of 5036 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 86 PID 2848 wrote to memory of 5036 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 86 PID 2848 wrote to memory of 5096 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 87 PID 2848 wrote to memory of 5096 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 87 PID 2848 wrote to memory of 5096 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 87 PID 2848 wrote to memory of 2828 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 90 PID 2848 wrote to memory of 2828 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 90 PID 2848 wrote to memory of 2828 2848 NEAS.5cdb301d0f8be8c516817c147e792a90.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5cdb301d0f8be8c516817c147e792a90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5cdb301d0f8be8c516817c147e792a90.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:5096
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.5cdb301d0f8be8c516817c147e792a90.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:2828
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2552
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD55cdb301d0f8be8c516817c147e792a90
SHA1d24c693bb6d7b6c76549210adb276ef9543a273c
SHA25682341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
SHA5126c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0
-
Filesize
119KB
MD55cdb301d0f8be8c516817c147e792a90
SHA1d24c693bb6d7b6c76549210adb276ef9543a273c
SHA25682341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
SHA5126c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0
-
Filesize
119KB
MD55cdb301d0f8be8c516817c147e792a90
SHA1d24c693bb6d7b6c76549210adb276ef9543a273c
SHA25682341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
SHA5126c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0
-
Filesize
119KB
MD55cdb301d0f8be8c516817c147e792a90
SHA1d24c693bb6d7b6c76549210adb276ef9543a273c
SHA25682341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
SHA5126c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0
-
Filesize
119KB
MD55cdb301d0f8be8c516817c147e792a90
SHA1d24c693bb6d7b6c76549210adb276ef9543a273c
SHA25682341c9feb25aa0d36b7fe9af56d8e61aaaf1cf0e019e7c28a396987283ce6a9
SHA5126c8b001d943b762f1344d3c413f81baff678310e6b48125911dca2e4d00ebea18341f57db8093aee4340ed5511e6a2f74096b5714e867701b094255f8e8c75d0