Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 05:20

General

  • Target

    98939d50cbc830ba60aedcd9ad66b7c4.exe

  • Size

    56KB

  • MD5

    98939d50cbc830ba60aedcd9ad66b7c4

  • SHA1

    03c95cd02c212f06ffdcb0cc39f5ab006bb69540

  • SHA256

    c0316592267b14ece7ecd856f73d280200814e5b349de0516229b8eb0af2671c

  • SHA512

    6d9cacfb4b67cb4b5b80912d985a79f968453d8e93dda9b4b94b06b7864bd8bab3a298ed49f62774b7b9fa44b556af252ccb9ee34ba06e8692d18e9a43f461a5

  • SSDEEP

    1536:1fUSMX+Ocm8FkNdRmM9+0yyOQ46r4vbm7EYv9FEa:1LMOxXFkNt+VbxG9FP

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98939d50cbc830ba60aedcd9ad66b7c4.exe
    "C:\Users\Admin\AppData\Local\Temp\98939d50cbc830ba60aedcd9ad66b7c4.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:800
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:5028
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\98939d50cbc830ba60aedcd9ad66b7c4.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:1396
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1948
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk-1.8\README.html

    Filesize

    263B

    MD5

    8e0789ff750b413c70a9b109432cf0ba

    SHA1

    84c429f3b741a44bced2a137ee62254348e89da6

    SHA256

    f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1

    SHA512

    36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899

  • C:\Program Files\Java\jdk-1.8\jre\Welcome.html

    Filesize

    1KB

    MD5

    8d076c963ea3bc917e719c8751339042

    SHA1

    4d1fde40544ea1b1610c26bf07c53dac30f7f6e8

    SHA256

    a7e014fae9f7d469ac7886ca9c881657d82e1864144b1a20b40b3b6db72084ad

    SHA512

    7aa40d6f9ea9caaa5af8cdd1fdfdffddf4c827c35a32b9a25520548e8d0d4cfb67307a82db0b2d6e81eb7cb5b53ad544f4425905fc179fca933a57e2c686ee47

  • C:\Program Files\Java\jre-1.8\Welcome.html

    Filesize

    1KB

    MD5

    09326e480b65cdf49b66907b306ee3f8

    SHA1

    3b9f59700f23acb2f84ea208f568978077b5bbcb

    SHA256

    835f9b8085789645eb9e72c88d9e928444a937eb53ade9a4d2266e57b65c0557

    SHA512

    cf5a03bb0e0c2019e1c5dfa88c3b0fba8580ed9df89a81f2dd49bfe4f8fd2568d5613da578ac243cfede9bec8e4f7d01b271ab681b244e3c2b295d42e9dd9d1f

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    56KB

    MD5

    98939d50cbc830ba60aedcd9ad66b7c4

    SHA1

    03c95cd02c212f06ffdcb0cc39f5ab006bb69540

    SHA256

    c0316592267b14ece7ecd856f73d280200814e5b349de0516229b8eb0af2671c

    SHA512

    6d9cacfb4b67cb4b5b80912d985a79f968453d8e93dda9b4b94b06b7864bd8bab3a298ed49f62774b7b9fa44b556af252ccb9ee34ba06e8692d18e9a43f461a5

  • memory/800-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/800-7-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/800-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1232-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1232-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1232-36-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1396-35-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/1948-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-38-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-40-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-41-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-16-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-60-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-79-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-932-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-3507-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1948-14-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/4688-4939-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/4688-3509-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/5028-11-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB