Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe
-
Size
63KB
-
MD5
0c9f0179483ce0a1b6198aefbba1b884
-
SHA1
6578fbbe0fdfde3ad3e915f42c2adf796904c6eb
-
SHA256
e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
-
SHA512
cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
SSDEEP
1536:kFWF62LnjwuheL+2fN/QmBs6M6DagdFSmw8V:YWXj7eJdQJmDLdF1wc
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4308 urdvxc.exe 780 urdvxc.exe 4944 urdvxc.exe 3964 urdvxc.exe 3420 urdvxc.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html urdvxc.exe File opened for modification C:\Program Files\SplitCheckpoint.htm urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\UninstallConfirm.shtml urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\README.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\nsstljje.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html urdvxc.exe -
Modifies registry class 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "slevjsxcjbtbeskc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\bklnbknw.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "wrknerlbhttnrlvj" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "hrjtxhjtzkljnhlt" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\\nsstljje.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "hkbkwzlrnlljsnsh" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\\njqrsbcq.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA17DDC6-7841-19DB-28E4-99CEB368F03B}\ = "jwrzlhzbcrhbvres" e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "jqqhwhlhwseckbck" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\ = "rehxcqbvrsshrckh´ù°\x06’qÍw{ŒÍwé¢w™" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nwbxweehxnzljrwe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qrsjlsszwhbbtljz" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "bcbbtxkljhjeshnb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wjkqtnkkwkcjbqjz" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "srtwesnrjwxkslln" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA17DDC6-7841-19DB-28E4-99CEB368F03B}\LocalServer32 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\ = "kkhrztwsxlrbqhbq" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA17DDC6-7841-19DB-28E4-99CEB368F03B} e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "xcjjrrlrrhhxqxhx" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "betzjtllbsbhlhnb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "hlnnextsnenrnlce" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lrertzrwkrlxjbwt" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA17DDC6-7841-19DB-28E4-99CEB368F03B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe" e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\LocalServer32\ = "C:\\Program Files\\Java\\jre1.8.0_66\\jtlnctqk.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4308 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2484 wrote to memory of 4308 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 76 PID 2484 wrote to memory of 4308 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 76 PID 2484 wrote to memory of 4308 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 76 PID 2484 wrote to memory of 780 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 77 PID 2484 wrote to memory of 780 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 77 PID 2484 wrote to memory of 780 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 77 PID 2484 wrote to memory of 3964 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 79 PID 2484 wrote to memory of 3964 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 79 PID 2484 wrote to memory of 3964 2484 e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe"C:\Users\Admin\AppData\Local\Temp\e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:780
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5.exe2⤵
- Executes dropped EXE
- Modifies registry class
PID:3964
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4944
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3420
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263B
MD5a49b242bc882b6e4f074b9a585227255
SHA13feca589f5ff852e04f82b7e01bbc688f3c4a390
SHA2561d347b95e2f7882576914db08a1191c288715118665a2e734a6a64addfeee9ac
SHA51234b55fd529c0eb5d1a33932046be34256dc7e09c9da7cddecb02c133d6b9326022b1b5bdfec7de5b73c53adeb4d198d954de56eb10c03ee5d0c5380af3458026
-
Filesize
1013B
MD5648b860830033a7b19b7a5b34e220aec
SHA16ae12502aeef514a600271a5d3969a9f2412346c
SHA256e6e95f429f3b411863c6eaf7b5f07f07a5a61f9c901b6c27d024da5d507a516c
SHA512abbc3fc79aa0174ab4843ced661314baeffb4a9d421f5d49351513b2a7f85f8c5a7cadb5c6c578ce8ae5c2d9be0dbabb319f47e0c1521e70a14d6eaaacf51c0e
-
Filesize
1KB
MD5126dc28a60fa70ca98434f1b6196855b
SHA1eaeb0f2ae09670985868a7410b08df899486339a
SHA2563475436612f6a0ef77fc91331d008090bfd53c7cc8535225762ab43234c730c7
SHA5127d07229039cbb7eb39d5cdf3846fb41f4f2f5a829cf7c0d5c778bf50c7eaa17ab7dd4c7fe483c38d3ebb72669d117a6db122ee58f63d712f795c38ad680ae52a
-
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html
Filesize1KB
MD5be5ae053c2e7447b4aa28a4eedd2596f
SHA1f3ec765d9a5cfef8126c3c0cca17f83bc3f30083
SHA2567b81f3095140ad8ff3083edd17f58f358464a6de33fe8b7d7059bf83b17621c3
SHA5128d77e56cc34fc9bbe5e1d2b0007b76a4899e522aa1be7473d2277547898ab122490d5c3a81415f20bf4efbee36560dd643f04d6f4639c309a3a50cac124d9d27
-
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html
Filesize6KB
MD5dd8bc4ea474d9b179f8f17874d2506b5
SHA13f50fdce3194a7fe6175363e78a7ee6b000a5072
SHA256b53adf89054311aaa69dd2cdf4df4f73dadbeda0d707befe592e3dd682611b07
SHA512f34548932fb35d88f69cb4f24389ed43dc1760c2b2de3d9fd9f3fa2fe20e7385967f76080865db42c3132105bb79a9b434ac89321d1a7cef9e1bbdce1232a35f
-
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html
Filesize1KB
MD517fb1125d8d7b6ed5f7fa28d774b076a
SHA1ebb3482859f785645178ee324257fb4df4bff1a1
SHA256500ca07ef68cc817d8352d142944089fdc1391e78bea103ae9a87c7e4aa12317
SHA5125016b950aad0006f62f443d1ef75baa88b44a810bd270b9c3140f417edc2372e18b2464f73c9b0f06b73f1208f6a9fad3b85fee9b6d8a785b788d34a6b1197c6
-
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
Filesize6KB
MD557e0cc238395714fa63306d6f3210cda
SHA1ff86a5ff6a1c252f21b1b5901d948022188dcfe8
SHA256bebe617b130d908db089db5c07baf16af2cacfa3a3f3ab2f0351475867e322fc
SHA51281df4d81fd7de5ed4513cc726593964c47274e36ba80d4c1c6f6a66743ecb1b1ea148805ffc24b4723a301ccbc07c37ea93dfb8815029dcdca6dec676c045b4b
-
Filesize
1KB
MD5cc118097036294f8f87572951e2d4766
SHA1a1a84b773de6be717e32d0ae818f2709f69364cf
SHA256adb5694c828f1297c08df978deb24469c68873695d14f2d0ee2d77c3b3d7bfc9
SHA5124a6ec98e62861e079f4afb235be89a11d941d55641babeb8e93c54b2c3c8d390ea733812fef859ccc1ccdfc563f8539cec8c8137756b5ac415c92a1829b884b2
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57
-
Filesize
63KB
MD50c9f0179483ce0a1b6198aefbba1b884
SHA16578fbbe0fdfde3ad3e915f42c2adf796904c6eb
SHA256e9e7e70b49cb7256dccbf9a3d3df0d68682addbfdc37bcbda59cb1250e095eb5
SHA512cdd1351e053f39b81e0b84ab3522fc837dab58f0ab62f11e9f822e63a5d1a45f97e70b1789d58fd6dffa847e6e525b22bdd15574ae86c282bf6d1dd1640bbc57