c51c5f40cef61eac6f7f089eaaf7ed01e7eb7b1d4784e4afdf2a49370a8e20b9

Analysis

max time kernel
64s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
31/01/2023, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UrbanVPN2.exe
Size 30.3MB
Sample230131-rzpvpsaf21
SHA256 c51c5f40cef61eac6f7f089eaaf7ed01e7eb7b1d4784e4afdf2a49370a8e20b9
MD5 15cdd9b014e75e1ead180d615df07bf5
SHA1 f0d8f4909730277956e01ada357e1ad12d7e14e8
SHA512 6d509c260f45aa5742a06fed9a7ea996a43bc38c48b709f6d7ca2ac2fab5be30b3b508b8e6d7a557d3687e693c09818a7f864c08724c76c244c2af710e6e0123
SSDEEP 786432:RtlRwYHHrrh2Y28c6k2OpHf71ovVIcbnkGR3Qf:R7vIHfhJgkGRW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 12 IoCs

pid	Process
2220	UrbanVPN2.exe
2220	UrbanVPN2.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	UrbanVPN2.exe
File opened (read-only)	\??\H:	UrbanVPN2.exe
File opened (read-only)	\??\L:	UrbanVPN2.exe
File opened (read-only)	\??\N:	UrbanVPN2.exe
File opened (read-only)	\??\O:	UrbanVPN2.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	UrbanVPN2.exe
File opened (read-only)	\??\M:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	UrbanVPN2.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	UrbanVPN2.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN2.exe
File opened (read-only)	\??\F:	UrbanVPN2.exe
File opened (read-only)	\??\J:	UrbanVPN2.exe
File opened (read-only)	\??\R:	UrbanVPN2.exe
File opened (read-only)	\??\W:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	UrbanVPN2.exe
File opened (read-only)	\??\V:	UrbanVPN2.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	UrbanVPN2.exe
File opened (read-only)	\??\G:	UrbanVPN2.exe
File opened (read-only)	\??\T:	UrbanVPN2.exe
File opened (read-only)	\??\U:	UrbanVPN2.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	UrbanVPN2.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	UrbanVPN2.exe
File opened (read-only)	\??\Z:	UrbanVPN2.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1608	msiexec.exe
Token: SeCreateTokenPrivilege	2220	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	2220	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	2220	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	2220	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	2220	UrbanVPN2.exe
Token: SeTcbPrivilege	2220	UrbanVPN2.exe
Token: SeSecurityPrivilege	2220	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	2220	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	2220	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	2220	UrbanVPN2.exe
Token: SeSystemtimePrivilege	2220	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	2220	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	2220	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	2220	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	2220	UrbanVPN2.exe
Token: SeBackupPrivilege	2220	UrbanVPN2.exe
Token: SeRestorePrivilege	2220	UrbanVPN2.exe
Token: SeShutdownPrivilege	2220	UrbanVPN2.exe
Token: SeDebugPrivilege	2220	UrbanVPN2.exe
Token: SeAuditPrivilege	2220	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	2220	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	2220	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	2220	UrbanVPN2.exe
Token: SeUndockPrivilege	2220	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	2220	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	2220	UrbanVPN2.exe
Token: SeManageVolumePrivilege	2220	UrbanVPN2.exe
Token: SeImpersonatePrivilege	2220	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	2220	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	2220	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	2220	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	2220	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	2220	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	2220	UrbanVPN2.exe
Token: SeTcbPrivilege	2220	UrbanVPN2.exe
Token: SeSecurityPrivilege	2220	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	2220	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	2220	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	2220	UrbanVPN2.exe
Token: SeSystemtimePrivilege	2220	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	2220	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	2220	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	2220	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	2220	UrbanVPN2.exe
Token: SeBackupPrivilege	2220	UrbanVPN2.exe
Token: SeRestorePrivilege	2220	UrbanVPN2.exe
Token: SeShutdownPrivilege	2220	UrbanVPN2.exe
Token: SeDebugPrivilege	2220	UrbanVPN2.exe
Token: SeAuditPrivilege	2220	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	2220	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	2220	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	2220	UrbanVPN2.exe
Token: SeUndockPrivilege	2220	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	2220	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	2220	UrbanVPN2.exe
Token: SeManageVolumePrivilege	2220	UrbanVPN2.exe
Token: SeImpersonatePrivilege	2220	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	2220	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	2220	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	2220	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	2220	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	2220	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	2220	UrbanVPN2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4428	1608	msiexec.exe	84
PID 1608 wrote to memory of 4428	1608	msiexec.exe	84
PID 1608 wrote to memory of 4428	1608	msiexec.exe	84

C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe
"C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 52B204904A0D7AD14FA9A339B86A8794 C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSI78A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI78A1.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI78A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI78A1.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI791F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI791F.tmp
Size 912KB
SHA256 0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147
MD5 b15dbf4b35cd1460ba283795e24878c8
SHA1 327812be4bfdce7a87cb00fab432ecc0d8c38c1e
SHA512 95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4
SSDEEP 24576:FmCzCf7c4yQ8xtgIZROly4aNXVW+hv+Ahi:8Rc4yQ8xtoly4aNXVW+hv+Ahi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI791F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI791F.tmp
Size 912KB
SHA256 0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147
MD5 b15dbf4b35cd1460ba283795e24878c8
SHA1 327812be4bfdce7a87cb00fab432ecc0d8c38c1e
SHA512 95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4
SSDEEP 24576:FmCzCf7c4yQ8xtgIZROly4aNXVW+hv+Ahi:8Rc4yQ8xtoly4aNXVW+hv+Ahi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7BEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7BEE.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7BEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7BEE.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7BFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7BFF.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7BFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7BFF.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7C10.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7C10.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7C10.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7C10.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7D0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7D0B.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7D0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7D0B.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7E73.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7E73.tmp
Size 602KB
SHA256 fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174
MD5 78b793e3f44b2c7849ffe70083c500c0
SHA1 9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61
SHA512 36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8
SSDEEP 12288:9YRaBw8WKAko59fOJd8k3mQ3oHb5MRjPQdwxQZ2V9SH+0K2:9i4Z3VoHNvdwCZ2V9SH+0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7E73.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7E73.tmp
Size 602KB
SHA256 fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174
MD5 78b793e3f44b2c7849ffe70083c500c0
SHA1 9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61
SHA512 36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8
SSDEEP 12288:9YRaBw8WKAko59fOJd8k3mQ3oHb5MRjPQdwxQZ2V9SH+0K2:9i4Z3VoHNvdwCZ2V9SH+0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7EC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7EC2.tmp
Size 912KB
SHA256 0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147
MD5 b15dbf4b35cd1460ba283795e24878c8
SHA1 327812be4bfdce7a87cb00fab432ecc0d8c38c1e
SHA512 95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4
SSDEEP 24576:FmCzCf7c4yQ8xtgIZROly4aNXVW+hv+Ahi:8Rc4yQ8xtoly4aNXVW+hv+Ahi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7EC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7EC2.tmp
Size 912KB
SHA256 0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147
MD5 b15dbf4b35cd1460ba283795e24878c8
SHA1 327812be4bfdce7a87cb00fab432ecc0d8c38c1e
SHA512 95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4
SSDEEP 24576:FmCzCf7c4yQ8xtgIZROly4aNXVW+hv+Ahi:8Rc4yQ8xtoly4aNXVW+hv+Ahi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7FEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7FEC.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7FEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7FEC.tmp
Size 495KB
SHA256 17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
MD5 cfab78ac0d042a1d8ad7085a94328ef6
SHA1 b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA512 647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
SSDEEP 6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI8358.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8358.tmp
Size 196KB
SHA256 da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4
MD5 efa1291d4eb0ff2050967dd63bfdbdc8
SHA1 54ba41d5a6fb192267b36127ff573cb112413fd8
SHA512 5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6
SSDEEP 3072:V5q/Kdo+ArSGYtKUtzXAzHzSskfsU11kxGPiF7BNMQofW0+7uOAg0FuDD4WWYzzp:Lq/Ki+3GDUVmH2RkxKiF7BTzAODfdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI8358.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8358.tmp
Size 196KB
SHA256 da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4
MD5 efa1291d4eb0ff2050967dd63bfdbdc8
SHA1 54ba41d5a6fb192267b36127ff573cb112413fd8
SHA512 5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6
SSDEEP 3072:V5q/Kdo+ArSGYtKUtzXAzHzSskfsU11kxGPiF7BNMQofW0+7uOAg0FuDD4WWYzzp:Lq/Ki+3GDUVmH2RkxKiF7BTzAODfdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\decoder.dll
Size 206KB
SHA256 780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
MD5 899944fb96ccc34cfbd2ccb9134367c5
SHA1 7c46aa3f84ba5da95ceff39cd49185672f963538
SHA512 2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
SSDEEP 3072:iltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMe4fyyERt:iaU87+3nHy6n0NF5ERt
MD5 SHA1 SHA512 SSDEEP

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\decoder.dll
Size 206KB
SHA256 780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
MD5 899944fb96ccc34cfbd2ccb9134367c5
SHA1 7c46aa3f84ba5da95ceff39cd49185672f963538
SHA512 2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
SSDEEP 3072:iltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMe4fyyERt:iaU87+3nHy6n0NF5ERt
MD5 SHA1 SHA512 SSDEEP

Submit Download