Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.35825139882fe6ca0d94e357012ca740.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.35825139882fe6ca0d94e357012ca740.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.35825139882fe6ca0d94e357012ca740.exe
-
Size
119KB
-
MD5
35825139882fe6ca0d94e357012ca740
-
SHA1
dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
-
SHA256
2d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
-
SHA512
82c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
-
SSDEEP
3072:yEyHrgBEo8OcvAJI5LlVwa1yuv2fdXyRik:y1MBEEJIFvDywSdXcik
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2212 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 1652 urdvxc.exe 4264 urdvxc.exe 972 urdvxc.exe 2212 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.35825139882fe6ca0d94e357012ca740.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.35825139882fe6ca0d94e357012ca740.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\UnpublishLimit.mhtml urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9633BD7-9CB8-949A-90B3-22F96DA57426} NEAS.35825139882fe6ca0d94e357012ca740.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "qcjvcwevhjbestej" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9633BD7-9CB8-949A-90B3-22F96DA57426}\ = "njjjeevzrclscwrz" NEAS.35825139882fe6ca0d94e357012ca740.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "njbkkrrbsthshheh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9633BD7-9CB8-949A-90B3-22F96DA57426}\LocalServer32 NEAS.35825139882fe6ca0d94e357012ca740.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "skqkhhcbllhckwjz" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "zjsxblebqewsbjhw" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "jjkbclrswejeshvb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lneqhcelhhvhrsbw" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tczeekctnlzbhjbl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9633BD7-9CB8-949A-90B3-22F96DA57426}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.35825139882fe6ca0d94e357012ca740.exe" NEAS.35825139882fe6ca0d94e357012ca740.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qwnvelnnrnknstcb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "sxkxhlbrkhvjwnwk" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1652 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4164 wrote to memory of 1652 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 87 PID 4164 wrote to memory of 1652 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 87 PID 4164 wrote to memory of 1652 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 87 PID 4164 wrote to memory of 4264 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 89 PID 4164 wrote to memory of 4264 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 89 PID 4164 wrote to memory of 4264 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 89 PID 4164 wrote to memory of 2212 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 93 PID 4164 wrote to memory of 2212 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 93 PID 4164 wrote to memory of 2212 4164 NEAS.35825139882fe6ca0d94e357012ca740.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.35825139882fe6ca0d94e357012ca740.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.35825139882fe6ca0d94e357012ca740.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:4264
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.35825139882fe6ca0d94e357012ca740.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:2212
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:972
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD535825139882fe6ca0d94e357012ca740
SHA1dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA2562d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA51282c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
-
Filesize
119KB
MD535825139882fe6ca0d94e357012ca740
SHA1dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA2562d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA51282c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
-
Filesize
119KB
MD535825139882fe6ca0d94e357012ca740
SHA1dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA2562d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA51282c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
-
Filesize
119KB
MD535825139882fe6ca0d94e357012ca740
SHA1dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA2562d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA51282c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
-
Filesize
119KB
MD535825139882fe6ca0d94e357012ca740
SHA1dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA2562d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA51282c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4