96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Size

62KB
MD5

96cd42c92b68e357621dd9b14ea5d571
SHA1

1c946ffab8485ddc191133a03143dca5b02716d0
SHA256

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6
SHA512

02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8
SSDEEP

1536:ytILkfv8tbWEtuM/lrWtObSLOlNkW+iUsGzmhclV9q4wsYK7fui4V/u1nT7:ytIFt3tb/lrWcUsp+sGyK0qYOmi4V/qH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

urdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

pid process

1604 urdvxc.exe
4992 urdvxc.exe
3380 urdvxc.exe
3928 urdvxc.exe
880 urdvxc.exe

pid	process
1604	urdvxc.exe
4992	urdvxc.exe
3380	urdvxc.exe
3928	urdvxc.exe
880	urdvxc.exe

Drops file in System32 directory 4 IoCs

Processes:

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exeurdvxc.exeurdvxc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\urdvxc.exe	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

Processes:

urdvxc.exeurdvxc.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\jtlnctqk.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\sekbhrbe.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe

Modifies registry class 58 IoCs

Processes:

urdvxc.exe96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exeurdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85AF1A9-0F96-2C63-4E1D-147595A02B59}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe"	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "lktjlsrsrextxhhl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\ = "chbbqrnbtnbssnlw"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "btbkhrtvhbhjlbvr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85AF1A9-0F96-2C63-4E1D-147595A02B59}\ = "vtvtlrrxknsrktkv"	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ennxjtnlltrtrnlk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rhzrvqrrkjvjhhke"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\bklnbknw.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\ = "vsejtswhhjheqeec"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "lbhwhsvhlrebljex"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85AF1A9-0F96-2C63-4E1D-147595A02B59}	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "tltjjslslccjbnsv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "wbhrlvczlvlhbhtn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85AF1A9-0F96-2C63-4E1D-147595A02B59}\LocalServer32	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\\nsstljje.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jhrvtecnqxjlnesr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bqklktkvbblwvnjw"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qjhlkkcvzvbeebnk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "nvxeeksqbblblxjt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "hckvhnsbcbxkkkhq"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C803653-A26A-88C7-574B-3B28BF06C94C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\\njqrsbcq.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CA91ECD-564C-3E29-5336-C066EB2FABF6}\LocalServer32\ = "C:\\Program Files\\Java\\jre1.8.0_66\\jtlnctqk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "hbxthljtlnevzrle"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

urdvxc.exe

description pid process

Token: SeDebugPrivilege 1604 urdvxc.exe

description	pid	process
Token: SeDebugPrivilege	1604	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe

description	pid	process	target process
PID 2124 wrote to memory of 1604	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 1604	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 1604	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 4992	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 4992	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 4992	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 3928	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 3928	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe
PID 2124 wrote to memory of 3928	2124	96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe	urdvxc.exe

C:\Users\Admin\AppData\Local\Temp\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
"C:\Users\Admin\AppData\Local\Temp\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /installservice
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /start
2⤵
- Executes dropped EXE
- Modifies registry class
PID:4992

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6.exe
2⤵
- Executes dropped EXE
- Modifies registry class
PID:3928

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3380

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.8.0_66\README.html

Filesize
263B

MD5
a49b242bc882b6e4f074b9a585227255

SHA1
3feca589f5ff852e04f82b7e01bbc688f3c4a390

SHA256
1d347b95e2f7882576914db08a1191c288715118665a2e734a6a64addfeee9ac

SHA512
34b55fd529c0eb5d1a33932046be34256dc7e09c9da7cddecb02c133d6b9326022b1b5bdfec7de5b73c53adeb4d198d954de56eb10c03ee5d0c5380af3458026

Download Submit
C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html

Filesize
1012B

MD5
661986eb37cc9cfc2f17614e81d71a6d

SHA1
6f5a8828691bfabda2656ba5435c39db61933cba

SHA256
5edb9dd67373164b6d5297e4fad9846c712451a74f8a8a965c39c61c19646a03

SHA512
11da83092eebe57cc2493d37f480bf706880883a1c4c7af910fe1e2d1fa3c923b7f6cca99d8bfc61255879ef146af94b0925cc07ca53c431b4ef1f24d36e970e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html

Filesize
1KB

MD5
126dc28a60fa70ca98434f1b6196855b

SHA1
eaeb0f2ae09670985868a7410b08df899486339a

SHA256
3475436612f6a0ef77fc91331d008090bfd53c7cc8535225762ab43234c730c7

SHA512
7d07229039cbb7eb39d5cdf3846fb41f4f2f5a829cf7c0d5c778bf50c7eaa17ab7dd4c7fe483c38d3ebb72669d117a6db122ee58f63d712f795c38ad680ae52a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html

Filesize
1KB

MD5
c0fa5ca9b3379e93fa396f0abfd555c2

SHA1
ea7b2eb2bd6dff6a804536b441bc0ca0bc00214f

SHA256
016b80189a11fc9d10b703fb8071f3159b96f3dab0ac3b72b465da1bef2f9cdb

SHA512
32a7636d235ad7c50aa6d5a9ee2c6e69187cb73bc3161e8b9346dba1fe3bdd246beac98dba7f49972432245c18c8393bf0b55e79a41a8a268152eafce90af55a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html

Filesize
6KB

MD5
8c89adec30342b7f1e04683101b99796

SHA1
69d2d07e557a4e89ea06e5250e4a955187d1dffc

SHA256
473f74d5bb41dea2cd0d72dbfe49452270d51e4466236b974405371947b6a819

SHA512
e5186eba0978ac956fdeb6456d1ef405ebdb1e5d57736a4eadecf51252b8d6296bac1f7366d4f8e246f747208853814eb117d37d12de1a30b0b945128dee0776

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html

Filesize
1KB

MD5
9442807e339a2e06ad66f128b83ef4a0

SHA1
62913f68cb5bc9a7112896f61ce9a93c0da0b69f

SHA256
14fc8355da60c09ed9dcfd637d6cd5d720dc13d98d872441d6adbc2d99345b9e

SHA512
0e0e342bcd99b7db22aca778f6b350e09aca1c144b080f1b3b272d0bfb80bfe9ee89fea94b69a999a4c873169ed26c7261f60fd681c6a404ce8f096125328426

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html

Filesize
6KB

MD5
038162681a2e7e218e32b05e8a91139d

SHA1
3bf8505c9596f7d46588630f8194ec564a8abe14

SHA256
ffebbeaa0905cf94e47376b5ebc0c2f752d1c21844dd1715c1d6447654da1e94

SHA512
6aeb1f4ca4d7ee8e7e8f2e2035fea198dea30c8f1e6266ceaaefa988b1954876db410f8059021b537ac7d155eb113d5a20584e10bea3471f342754601c26c91e

Download Submit
C:\Program Files\Java\jre1.8.0_66\Welcome.html

Filesize
1KB

MD5
cf60cf8a645752e5779bd777fb93a225

SHA1
5074b3529cccac4ab7d8c34c67d590c1408c44e0

SHA256
22e021becaee1190e3e3443eb74b474575eee3ed9b4a1cd42b8d47c60070ae14

SHA512
f264ad7707dfad5b4c42f45a392e46351853701655652493d383fc36e0a588f7b3f634ebebdee0c958dce8cc6bf277476b34b21fc6ca9e3edd9cbf9613a50558

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
62KB

MD5
96cd42c92b68e357621dd9b14ea5d571

SHA1
1c946ffab8485ddc191133a03143dca5b02716d0

SHA256
96a0778d76aac41a7d8d150b032171a7bda470e3134e7d93346478284dfe32d6

SHA512
02f1f47b00b1c4c97fc85057fb510ea1c4d1818a81a6646cd087965480b2afd3d5e1176b0f9e94f97c077d3cb282ee6d9647918731c17a7ee8672c9a3079f2d8

Download Submit
memory/880-150-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/880-151-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1604-138-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1604-137-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1604-134-0x0000000000000000-mapping.dmp

Download
memory/2124-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2124-133-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3380-147-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/3380-148-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/3380-143-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/3928-146-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/3928-144-0x0000000000000000-mapping.dmp

Download
memory/4992-142-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4992-139-0x0000000000000000-mapping.dmp

Download