Analysis
-
max time kernel
172s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 11:22
General
-
Target
8f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753.exe
-
Size
128KB
-
MD5
49f2107b49b2722942e0d72c37a5db1f
-
SHA1
b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
-
SHA256
8f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
-
SHA512
dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
SSDEEP
3072:zGDxbgTf57c0f6M1QiKYSRHWS+fMm/s/WKt3/FKWRjkN:zGFbgTlTf6MOiKYqHWS+9/s/t/FKWRI
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 45 IoCs
-
Modifies registry class 38 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753.exe"C:\Users\Admin\AppData\Local\Temp\8f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\8f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753.exe2⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD549f2107b49b2722942e0d72c37a5db1f
SHA1b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
SHA2568f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
SHA512dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
Filesize
128KB
MD549f2107b49b2722942e0d72c37a5db1f
SHA1b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
SHA2568f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
SHA512dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
Filesize
128KB
MD549f2107b49b2722942e0d72c37a5db1f
SHA1b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
SHA2568f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
SHA512dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
Filesize
128KB
MD549f2107b49b2722942e0d72c37a5db1f
SHA1b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
SHA2568f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
SHA512dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
Filesize
128KB
MD549f2107b49b2722942e0d72c37a5db1f
SHA1b170fb3c58b54132efa37e59e0a7f6bc2e7021fc
SHA2568f62dd9beaf8fb851268b4c42a5f2fd70039c7c89b36f811644b74d82ed6d753
SHA512dadb7fd6426d163b5b3b60a02d42810386142bfee2da43f1bd59b57b0707288d08a2843a7168f7517a984da01661c9a4b099476d8fa083c5b76cc4c4fb0a5f77
-
Filesize
124KB
-
-
Filesize
124KB
-
Filesize
124KB
-
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
205KB
-
-
Filesize
205KB
-
Filesize
124KB