Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 07:05
Static task
static1
Behavioral task
behavioral1
Sample
до судового запиту.docx.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target до судового запиту.docx.exe
- Size 20.6MB
- Sample210809-hl3vm1w22n
- SHA256 e780d9132b814b9ee7514918da9badd98afc454a01bb5233e13e0db8f192e888
- MD5 d7084b169082cd511badf160d4f74c33
- SHA1 6ab02d048b706167808e98bbda4a86367ab26f6f
- SHA512 c562710f56b0b4a6900edc1f14c7b3e7541976e5c31af81a70b41e237ecd6bfd7f7d78054e49481073fb2f39a316bd3f7257a13291351861992cb05ce395f03f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 13 1540 msiexec.exe 15 1540 msiexec.exe - Executes dropped EXE 10 IoCs
pid Process 2976 2.exe 3888 rfusclient.exe 748 rutserv.exe 4192 rutserv.exe 4380 rutserv.exe 4500 rutserv.exe 4760 rfusclient.exe 4772 rfusclient.exe 4268 rfusclient.exe 4192 rutserv.exe -
resource yara_rule behavioral2/files/0x000200000001ab52-119.dat upx behavioral2/files/0x000200000001ab52-118.dat upx - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation rfusclient.exe - Loads dropped DLL 11 IoCs
pid Process 2184 MsiExec.exe 748 rutserv.exe 748 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rutserv.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Korean.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-08.html rutserv.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\French.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Italian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe msiexec.exe File opened for modification C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-08.html rutserv.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\German.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Danish.lg msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4915.tmp msiexec.exe File created C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File created C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File created C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File created C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File opened for modification C:\Windows\Installer\f744135.msi msiexec.exe File created C:\Windows\Installer\SourceHash{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1} msiexec.exe File opened for modification C:\Windows\Installer\MSI4F4F.tmp msiexec.exe File created C:\Windows\Installer\f744138.msi msiexec.exe File opened for modification C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\f744135.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File opened for modification C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rutserv.exe - Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FC14047F4EBB114788DC1F0AA671D1F\RMS msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\AuthorizedLUAApp = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\2FC14047F4EBB114788DC1F0AA671D1F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FC14047F4EBB114788DC1F0AA671D1F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\PackageCode = "452F584C78591D24EA42B93A1EB17D2C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Version = "117440512" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\PackageName = "host7.0.0.3_unsigned.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{072059F5-E6E5-4081-81EF-CC019E8E816E}\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings до судового запиту.docx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{072059F5-E6E5-4081-81EF-CC019E8E816E}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\ProductName = "Remote Utilities - Host" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\ProductIcon = "C:\\Windows\\Installer\\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media msiexec.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2248 WINWORD.EXE 2248 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2976 2.exe 2976 2.exe 2976 2.exe 2976 2.exe 3888 rfusclient.exe 3888 rfusclient.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4772 rfusclient.exe 4772 rfusclient.exe 4760 rfusclient.exe 4760 rfusclient.exe 4760 rfusclient.exe 4760 rfusclient.exe 4268 rfusclient.exe 4268 rfusclient.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe - Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 4268 rfusclient.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3712 msiexec.exe Token: SeIncreaseQuotaPrivilege 3712 msiexec.exe Token: SeSecurityPrivilege 1540 msiexec.exe Token: SeCreateTokenPrivilege 3712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3712 msiexec.exe Token: SeLockMemoryPrivilege 3712 msiexec.exe Token: SeIncreaseQuotaPrivilege 3712 msiexec.exe Token: SeMachineAccountPrivilege 3712 msiexec.exe Token: SeTcbPrivilege 3712 msiexec.exe Token: SeSecurityPrivilege 3712 msiexec.exe Token: SeTakeOwnershipPrivilege 3712 msiexec.exe Token: SeLoadDriverPrivilege 3712 msiexec.exe Token: SeSystemProfilePrivilege 3712 msiexec.exe Token: SeSystemtimePrivilege 3712 msiexec.exe Token: SeProfSingleProcessPrivilege 3712 msiexec.exe Token: SeIncBasePriorityPrivilege 3712 msiexec.exe Token: SeCreatePagefilePrivilege 3712 msiexec.exe Token: SeCreatePermanentPrivilege 3712 msiexec.exe Token: SeBackupPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 3712 msiexec.exe Token: SeShutdownPrivilege 3712 msiexec.exe Token: SeDebugPrivilege 3712 msiexec.exe Token: SeAuditPrivilege 3712 msiexec.exe Token: SeSystemEnvironmentPrivilege 3712 msiexec.exe Token: SeChangeNotifyPrivilege 3712 msiexec.exe Token: SeRemoteShutdownPrivilege 3712 msiexec.exe Token: SeUndockPrivilege 3712 msiexec.exe Token: SeSyncAgentPrivilege 3712 msiexec.exe Token: SeEnableDelegationPrivilege 3712 msiexec.exe Token: SeManageVolumePrivilege 3712 msiexec.exe Token: SeImpersonatePrivilege 3712 msiexec.exe Token: SeCreateGlobalPrivilege 3712 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe Token: SeRestorePrivilege 1540 msiexec.exe Token: SeTakeOwnershipPrivilege 1540 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4772 rfusclient.exe 4772 rfusclient.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4772 rfusclient.exe 4772 rfusclient.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 2976 2.exe 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 2248 WINWORD.EXE 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 748 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 4380 rutserv.exe 2248 WINWORD.EXE 2248 WINWORD.EXE 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4500 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe 4192 rutserv.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4068 wrote to memory of 2248 4068 до судового запиту.docx.exe 74 PID 4068 wrote to memory of 2248 4068 до судового запиту.docx.exe 74 PID 4068 wrote to memory of 2976 4068 до судового запиту.docx.exe 76 PID 4068 wrote to memory of 2976 4068 до судового запиту.docx.exe 76 PID 4068 wrote to memory of 2976 4068 до судового запиту.docx.exe 76 PID 2976 wrote to memory of 3712 2976 2.exe 77 PID 2976 wrote to memory of 3712 2976 2.exe 77 PID 2976 wrote to memory of 3712 2976 2.exe 77 PID 1540 wrote to memory of 2184 1540 msiexec.exe 79 PID 1540 wrote to memory of 2184 1540 msiexec.exe 79 PID 1540 wrote to memory of 2184 1540 msiexec.exe 79 PID 1540 wrote to memory of 3888 1540 msiexec.exe 80 PID 1540 wrote to memory of 3888 1540 msiexec.exe 80 PID 1540 wrote to memory of 3888 1540 msiexec.exe 80 PID 1540 wrote to memory of 748 1540 msiexec.exe 82 PID 1540 wrote to memory of 748 1540 msiexec.exe 82 PID 1540 wrote to memory of 748 1540 msiexec.exe 82 PID 1540 wrote to memory of 4192 1540 msiexec.exe 84 PID 1540 wrote to memory of 4192 1540 msiexec.exe 84 PID 1540 wrote to memory of 4192 1540 msiexec.exe 84 PID 1540 wrote to memory of 4380 1540 msiexec.exe 85 PID 1540 wrote to memory of 4380 1540 msiexec.exe 85 PID 1540 wrote to memory of 4380 1540 msiexec.exe 85 PID 4500 wrote to memory of 4760 4500 rutserv.exe 89 PID 4500 wrote to memory of 4760 4500 rutserv.exe 89 PID 4500 wrote to memory of 4760 4500 rutserv.exe 89 PID 4500 wrote to memory of 4772 4500 rutserv.exe 88 PID 4500 wrote to memory of 4772 4500 rutserv.exe 88 PID 4500 wrote to memory of 4772 4500 rutserv.exe 88 PID 4760 wrote to memory of 4268 4760 rfusclient.exe 95 PID 4760 wrote to memory of 4268 4760 rfusclient.exe 95 PID 4760 wrote to memory of 4268 4760 rfusclient.exe 95 PID 4500 wrote to memory of 4192 4500 rutserv.exe 97 PID 4500 wrote to memory of 4192 4500 rutserv.exe 97 PID 4500 wrote to memory of 4192 4500 rutserv.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\до судового запиту.docx.exe"C:\Users\Admin\AppData\Local\Temp\до судового запиту.docx.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{072059F5-E6E5-4081-81EF-CC019E8E816E}\host7.0.0.3_unsigned.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B7E4EAAA060805BE2AA7AB1C923C8352⤵
- Loads dropped DLL
PID:2184
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{072059F5-E6E5-4081-81EF-CC019E8E816E}\host7.0.0.3_unsigned.msi"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4772
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
PID:4268
-
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:4892