Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
25628873069f71fe0b875d953376d2d0_NEIKI.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25628873069f71fe0b875d953376d2d0_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
25628873069f71fe0b875d953376d2d0_NEIKI.exe
-
Size
119KB
-
MD5
25628873069f71fe0b875d953376d2d0
-
SHA1
e0ab994999095deca19d24248160ba7195a961aa
-
SHA256
3b129bcf58db2c17c36b401911228cb1a5c87e599b15e55cdb73da59a6dc589b
-
SHA512
36c42ebfb9a3a6a3e07b400c0d3bf8189052f6444c5e615d00dc3a61d7c96b7350713b24d27306f0ef1e4506c7bbfff8eb8a301e5e8d9a22add965fb8e45e511
-
SSDEEP
3072:l960s4c3kzhbPSz+pENx7upuXnqxXXn3g43UDKZa5:l96gc32hbPuQkupuqxH3g43UDr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3600 urdvxc.exe -
Executes dropped EXE 5 IoCs
pid Process 4440 urdvxc.exe 2364 urdvxc.exe 3936 urdvxc.exe 3600 urdvxc.exe 3276 urdvxc.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe 25628873069f71fe0b875d953376d2d0_NEIKI.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe 25628873069f71fe0b875d953376d2d0_NEIKI.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe -
Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "etwvveljjlrnxjvz" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nrxkrevhcelrlbln" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{460F0422-82F8-2A56-8B99-944EF24BAC2E}\ = "klztvktlltcehkch" 25628873069f71fe0b875d953376d2d0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ejqtebscztnlhnhz" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{460F0422-82F8-2A56-8B99-944EF24BAC2E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\25628873069f71fe0b875d953376d2d0_NEIKI.exe" 25628873069f71fe0b875d953376d2d0_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{460F0422-82F8-2A56-8B99-944EF24BAC2E}\LocalServer32 25628873069f71fe0b875d953376d2d0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ltllwvvjwbetwlvc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nvnttsswlknqslhr" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{460F0422-82F8-2A56-8B99-944EF24BAC2E} 25628873069f71fe0b875d953376d2d0_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "htqskskvbvkkvhjc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tsttrnrnrwrhhjbj" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "bxvtbstlrzkenhjx" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "khkzvtbhtlchjnkb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "ncnbskkxshkzjses" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4440 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1964 wrote to memory of 4440 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 90 PID 1964 wrote to memory of 4440 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 90 PID 1964 wrote to memory of 4440 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 90 PID 1964 wrote to memory of 2364 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 91 PID 1964 wrote to memory of 2364 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 91 PID 1964 wrote to memory of 2364 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 91 PID 1964 wrote to memory of 3600 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 93 PID 1964 wrote to memory of 3600 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 93 PID 1964 wrote to memory of 3600 1964 25628873069f71fe0b875d953376d2d0_NEIKI.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\25628873069f71fe0b875d953376d2d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\25628873069f71fe0b875d953376d2d0_NEIKI.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:2364
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\25628873069f71fe0b875d953376d2d0_NEIKI.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:3600
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4120,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:81⤵PID:908
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3276
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263B
MD58e0789ff750b413c70a9b109432cf0ba
SHA184c429f3b741a44bced2a137ee62254348e89da6
SHA256f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
SHA51236b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
-
Filesize
1KB
MD583c3593f3f27877707dd95a61f31603d
SHA184bb9e08140633dc17eddde03a7cf01fa189cd60
SHA2564010040c44bda7a691dbc90157bb9e82d12a1cabcab9829fce063cf1d7b641a7
SHA5122fac6032225a6de026078627c0c367bf2facbab9f8fc1a3600bf66e327badb3159230c9b044779022a41a119f656175bdcb4020125e662a19b62b228b17d6203
-
Filesize
1KB
MD5bc7c57b483916c6260cf0467bd8f0817
SHA180d1f7095e14da4ba8e73252d998f2979b5038d3
SHA25617199b56ed55902544a9c13f4f263cd0ce15ed1bc63ab1f49df634c732b5a48c
SHA512f2bc75c0fc8b02751db4ff98fe3fe36d9117dd1d748bdf03d78f72a6b7fada03e6832d5123a5c3e9aadf2bf92a266cd76ca9beb3914efc09ccbc99cc24467ced
-
Filesize
1KB
MD575887f366667b2254dfd35014d4eb318
SHA103127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA256fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
SHA512953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Filesize11KB
MD54c7125f69cf2046a45daeac49cb0019f
SHA1b4b17fbe1091003ed480f40654f22c89c763f01b
SHA2561102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
SHA512ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
-
Filesize
119KB
MD525628873069f71fe0b875d953376d2d0
SHA1e0ab994999095deca19d24248160ba7195a961aa
SHA2563b129bcf58db2c17c36b401911228cb1a5c87e599b15e55cdb73da59a6dc589b
SHA51236c42ebfb9a3a6a3e07b400c0d3bf8189052f6444c5e615d00dc3a61d7c96b7350713b24d27306f0ef1e4506c7bbfff8eb8a301e5e8d9a22add965fb8e45e511