25ad36543981e5a71ec55d784d88d5b9f605d317e21342dfba690556405a2a2f

Analysis

max time kernel
172s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61802d5c931b4818af86e6fec63487a0.exe
Size

66KB
MD5

61802d5c931b4818af86e6fec63487a0
SHA1

981ad23a63f4f9b6362d2c531a47f8f13310368e
SHA256

25ad36543981e5a71ec55d784d88d5b9f605d317e21342dfba690556405a2a2f
SHA512

03738e66251edc04acec1b715e824f43a8b62bb687dcc3f10b4137b9363a1fb5041ae51749d8ac32150d801c2d440b175308857f1a5feb03d1e75855e49c0ba3
SSDEEP

1536:5uujL0ZkvwDyKRXDJ1BAzLVdz0dMRwi8M1zWALSdaoAQ:51L0ZkvikIdH7M1Soi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4080	urdvxc.exe
2464	urdvxc.exe
4392	urdvxc.exe
2972	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	61802d5c931b4818af86e6fec63487a0.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	61802d5c931b4818af86e6fec63487a0.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\EnableInitialize.htm	urdvxc.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "jchhtelxlsqwksjk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "qhlbhscbtnhbzjql"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E46C4C00-F826-CA8A-2351-BA27F43977A1}\LocalServer32	61802d5c931b4818af86e6fec63487a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kljrthehvzrclbjr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E46C4C00-F826-CA8A-2351-BA27F43977A1}	61802d5c931b4818af86e6fec63487a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "stkhktvcebcnnbes"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E46C4C00-F826-CA8A-2351-BA27F43977A1}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\61802d5c931b4818af86e6fec63487a0.exe"	61802d5c931b4818af86e6fec63487a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "keeehltvtjvvvlzk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E46C4C00-F826-CA8A-2351-BA27F43977A1}\ = "lbtjbtsekbqlssek"	61802d5c931b4818af86e6fec63487a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "xhesjzvnwrjklsjx"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4080	4652	61802d5c931b4818af86e6fec63487a0.exe	95
PID 4652 wrote to memory of 4080	4652	61802d5c931b4818af86e6fec63487a0.exe	95
PID 4652 wrote to memory of 4080	4652	61802d5c931b4818af86e6fec63487a0.exe	95
PID 4652 wrote to memory of 2464	4652	61802d5c931b4818af86e6fec63487a0.exe	96
PID 4652 wrote to memory of 2464	4652	61802d5c931b4818af86e6fec63487a0.exe	96
PID 4652 wrote to memory of 2464	4652	61802d5c931b4818af86e6fec63487a0.exe	96
PID 4652 wrote to memory of 2972	4652	61802d5c931b4818af86e6fec63487a0.exe	98
PID 4652 wrote to memory of 2972	4652	61802d5c931b4818af86e6fec63487a0.exe	98
PID 4652 wrote to memory of 2972	4652	61802d5c931b4818af86e6fec63487a0.exe	98

C:\Users\Admin\AppData\Local\Temp\61802d5c931b4818af86e6fec63487a0.exe
"C:\Users\Admin\AppData\Local\Temp\61802d5c931b4818af86e6fec63487a0.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2464
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\61802d5c931b4818af86e6fec63487a0.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2972

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
61802d5c931b4818af86e6fec63487a0

SHA1
981ad23a63f4f9b6362d2c531a47f8f13310368e

SHA256
25ad36543981e5a71ec55d784d88d5b9f605d317e21342dfba690556405a2a2f

SHA512
03738e66251edc04acec1b715e824f43a8b62bb687dcc3f10b4137b9363a1fb5041ae51749d8ac32150d801c2d440b175308857f1a5feb03d1e75855e49c0ba3

Download Submit
memory/2464-9-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2972-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2972-39-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4080-38-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4080-7-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4392-45-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-49-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-19-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-20-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-21-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-22-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-23-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-24-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-25-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-26-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-27-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-28-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-29-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-30-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-31-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-32-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-33-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-48-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-35-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-14-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-36-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-1314-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-80-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-79-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-78-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-40-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-41-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-42-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-43-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-44-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-13-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-46-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-15-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-47-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-34-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-50-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-51-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-52-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-53-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-54-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-55-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-56-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-57-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-58-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-59-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-60-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-61-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-62-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-63-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-64-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-65-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-66-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-67-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-68-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-69-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-70-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-71-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-72-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-73-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-74-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-75-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-76-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4392-77-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4652-37-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4652-2-0x0000000000500000-0x000000000051F000-memory.dmp

Filesize
124KB

Download
memory/4652-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4652-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download