Analysis date (UTC): 20 July 2019, 11:50Analysis environment: Windows 7 Pro, build 7601, x86

UrbanVPN.exe

MD5:8CD6F64CFF429B6091C718DC1A132182

SHA1:3347057EF0CC04522A9E84A5A99F68EF4F542A83

SHA256:5C8D5558F735A92EF5A028268DA767E9A76034127CCA854016D711914A847A56

Analysis result

Threat level:Malicious activity

Full analysis:Analysis UrbanVPN.exe (MD5: 8CD6F64CFF429B6091C718DC1A132182) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

UrbanVPN.exe (PID: 3700)
urbanvpnserv.exe (PID: 2804)
urbanvpn.exe (PID: 3632)
urbanvpn-gui.exe (PID: 2136)
urbanvpn.exe (PID: 2220)

Application was dropped or rewritten from another process

ns6A0.tmp (PID: 2152)
tapinstall.exe (PID: 2464)
nsCDB.tmp (PID: 288)
tapinstall.exe (PID: 2340)
urbanvpnserv.exe (PID: 2804)
UrbanVPNUpdater.exe (PID: 3988)
urbanvpn-gui.exe (PID: 2136)
urbanvpn.exe (PID: 3632)
urbanvpn.exe (PID: 2220)

Changes settings of System certificates

UrbanVPNUpdater.exe (PID: 3988)

Loads the Task Scheduler DLL interface

UrbanVPN.exe (PID: 3700)

SUSPICIOUS

Executable content was dropped or overwritten

UrbanVPN.exe (PID: 3700)
msiexec.exe (PID: 4064)
MSI1E1.tmp (PID: 2424)
tapinstall.exe (PID: 2340)
DrvInst.exe (PID: 3828)
DrvInst.exe (PID: 3784)

Creates files in the user directory

UrbanVPN.exe (PID: 3700)
MsiExec.exe (PID: 4020)

Reads Environment values

MsiExec.exe (PID: 4020)
MsiExec.exe (PID: 1336)

Executed as Windows Service

vssvc.exe (PID: 3528)
urbanvpnserv.exe (PID: 2804)

Reads Internet Cache Settings

UrbanVPN.exe (PID: 3700)

Application launched itself

UrbanVPN.exe (PID: 3700)

Executed via COM

DrvInst.exe (PID: 2840)
DrvInst.exe (PID: 3828)
DrvInst.exe (PID: 3784)
DllHost.exe (PID: 2632)
FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2872)

Reads internet explorer settings

UrbanVPN.exe (PID: 3700)

Creates files in the program directory

MSI1E1.tmp (PID: 2424)
urbanvpn-gui.exe (PID: 2136)
UrbanVPNUpdater.exe (PID: 3988)

Starts application with an unusual extension

MSI1E1.tmp (PID: 2424)

Creates files in the driver directory

DrvInst.exe (PID: 3828)
DrvInst.exe (PID: 3784)

Uses RUNDLL32.EXE to load library

DrvInst.exe (PID: 3828)

Removes files from Windows directory

DrvInst.exe (PID: 3828)
DrvInst.exe (PID: 3784)

Creates files in the Windows directory

DrvInst.exe (PID: 3828)
DrvInst.exe (PID: 3784)

Creates a software uninstall entry

MSI1E1.tmp (PID: 2424)

Changes the autorun value in the registry

msiexec.exe (PID: 4064)

Low-level read access rights to disk partition

urbanvpnserv.exe (PID: 2804)

Reads the machine GUID from the registry

urbanvpnserv.exe (PID: 2804)

Adds / modifies Windows certificates

UrbanVPNUpdater.exe (PID: 3988)

INFO

Application launched itself

msiexec.exe (PID: 4064)
iexplore.exe (PID: 3552)

Loads dropped or rewritten executable

MsiExec.exe (PID: 4020)
MsiExec.exe (PID: 840)
MSI1E1.tmp (PID: 2424)
MsiExec.exe (PID: 1336)

Low-level read access rights to disk partition

vssvc.exe (PID: 3528)

Searches for installed software

msiexec.exe (PID: 4064)

Starts application with an unusual extension

msiexec.exe (PID: 4064)

Application was dropped or rewritten from another process

MSI1E1.tmp (PID: 2424)

Creates files in the program directory

msiexec.exe (PID: 4064)

Creates a software uninstall entry

msiexec.exe (PID: 4064)

Creates files in the user directory

FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2872)
iexplore.exe (PID: 3008)
iexplore.exe (PID: 3552)

Changes internet zones settings

iexplore.exe (PID: 3552)

Manual execution by user

iexplore.exe (PID: 3552)

Reads internet explorer settings

iexplore.exe (PID: 3008)

Reads Internet Cache Settings

iexplore.exe (PID: 3008)

Reads settings of System Certificates

iexplore.exe (PID: 3552)

Threats

PID	Process	Class	Message
840	MsiExec.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Jetmedia.A
2804	urbanvpnserv.exe	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent
840	MsiExec.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Jetmedia.A
2804	urbanvpnserv.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Jetmedia.A
2804	urbanvpnserv.exe	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent
840	MsiExec.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Jetmedia.A