Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe
-
Size
119KB
-
MD5
1ab6cbe2e4af803c56313d71d44d10e0
-
SHA1
112d6296ef721dc210a2cb06fa846eb33a74400a
-
SHA256
aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
-
SHA512
56e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7
-
SSDEEP
3072:sSTqKrbz15PtNsQlNvaZKstxT+p5drnQ9Ehw:sEPzzwQlNyZKIxY5ZnQ9ww
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3936 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 2768 urdvxc.exe 880 urdvxc.exe 1852 urdvxc.exe 3936 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9739786E-373D-C064-2680-ABD0070299EE}\LocalServer32 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9739786E-373D-C064-2680-ABD0070299EE} NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9739786E-373D-C064-2680-ABD0070299EE}\ = "ktskbeljkkrvrhth" NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "lbntvnznwtenvvrs" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bjbwrbqqrkntkesj" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bljvtsktqhzvbslj" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9739786E-373D-C064-2680-ABD0070299EE}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe" NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "sjljxsxkqktznlkj" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nlcljntrhlewwnqj" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kezjjkeslnrwrjsl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "ezknntvqettexzlc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nrrkebnwxnsklskh" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "bentejvzvncbtekj" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2768 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3580 wrote to memory of 2768 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 85 PID 3580 wrote to memory of 2768 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 85 PID 3580 wrote to memory of 2768 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 85 PID 3580 wrote to memory of 880 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 89 PID 3580 wrote to memory of 880 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 89 PID 3580 wrote to memory of 880 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 89 PID 3580 wrote to memory of 3936 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 92 PID 3580 wrote to memory of 3936 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 92 PID 3580 wrote to memory of 3936 3580 NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:880
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.1ab6cbe2e4af803c56313d71d44d10e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:3936
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1852
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD51ab6cbe2e4af803c56313d71d44d10e0
SHA1112d6296ef721dc210a2cb06fa846eb33a74400a
SHA256aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
SHA51256e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7
-
Filesize
119KB
MD51ab6cbe2e4af803c56313d71d44d10e0
SHA1112d6296ef721dc210a2cb06fa846eb33a74400a
SHA256aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
SHA51256e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7
-
Filesize
119KB
MD51ab6cbe2e4af803c56313d71d44d10e0
SHA1112d6296ef721dc210a2cb06fa846eb33a74400a
SHA256aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
SHA51256e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7
-
Filesize
119KB
MD51ab6cbe2e4af803c56313d71d44d10e0
SHA1112d6296ef721dc210a2cb06fa846eb33a74400a
SHA256aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
SHA51256e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7
-
Filesize
119KB
MD51ab6cbe2e4af803c56313d71d44d10e0
SHA1112d6296ef721dc210a2cb06fa846eb33a74400a
SHA256aa6540a280d0868b338582dbc382cff4a26ed41a86819e37050fa6c628abfdf7
SHA51256e96bf83bddbb7dfc260bb1aecab8fd3b181ed3c79d112710d71be795571afa62240b12fc762343b46799d096b7c605cb576895a49dbc9040d689a98be2bca7