Analysis
- max time kernel
162s - max time network
166s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe
- Size 11.5MB
- Sample220128-18ekrsfadm
- SHA256 15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa
- MD5 6294f6f6879904ccf09b8a236684aab4
- SHA1 16e8e0d0ad4b6c2d6e080d8b7d2a820c9850d3fc
- SHA512 80bb99c85eac504b7861c9be8124f323ac4b514612356cc7c49fe544ef586095deecff6a831a3c0e5b5027f0f4e7c8953df6f635778de0d410375d453904b109
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 17 2228 msiexec.exe 18 2228 msiexec.exe 20 2228 msiexec.exe - Executes dropped EXE 17 IoCs
pid Process 1212 installer.exe 2696 rfusclient.exe 2208 rutserv.exe 3028 rutserv.exe 3100 rutserv.exe 3180 srvinst_x64.exe 3156 srvinst_x64.exe 1248 setupdrv.exe 4020 setupdrv.exe 3156 srvinst_x64.exe 3668 VPDAgent_x64.exe 3860 srvinst_x64.exe 2748 rutserv.exe 4092 rutserv.exe 3460 rfusclient.exe 784 rfusclient.exe 2836 rfusclient.exe - Registers new Print Monitor 2 TTPs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation installer.exe Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation rfusclient.exe - Loads dropped DLL 28 IoCs
pid Process 1696 MsiExec.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 43 IoCs
description ioc Process File opened for modification C:\Windows\system32\spool\DRIVERS\x64\rup.ini spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.dll spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.ini spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui2.exe spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.dll spoolsv.exe File opened for modification C:\Windows\system32\ruppm.dll setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\rupui.dll setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\rup.lng setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp setupdrv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\rup.gpd spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.gpd spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\stdnames_vpd.gpd spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\unires_vpd.dll spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\rupui.dll spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 rutserv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 rutserv.exe File created C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.dll setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll setupdrv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\rup.lng spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe File created C:\Windows\system32\spool\DRIVERS\x64\rup.ini setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrvui_rup.dll spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rutserv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui.dll spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\rup.BUD spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rutserv.exe File created C:\Windows\system32\ruppm.dll setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\rup.gpd setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe setupdrv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.hlp spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6 rutserv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.lng spoolsv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6 rutserv.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\French.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Danish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Italian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rup.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\German.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll msiexec.exe File opened for modification C:\Program Files (x86)\Remote Utilities - Host\Logs\rms_log_2022-01.html rutserv.exe File created C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Polish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Czech.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Korean.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg msiexec.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76273b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI37E4.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{E945283B-758C-4A40-B851-1066D0E49EA8} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI44C6.tmp msiexec.exe File created C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File created C:\Windows\VPDAgent_x64.exe srvinst_x64.exe File opened for modification C:\Windows\VPDAgent_x64.exe srvinst_x64.exe File opened for modification C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\f76273b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f76273e.msi msiexec.exe File created C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File created C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File created C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File opened for modification C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Printers\DevModePerUser spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Remote Utilities Printer = "winspool,rup,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Remote Utilities Printer = "winspool,rup" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Remote Utilities Printer = "winspool,rup,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rutserv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rutserv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Remote Utilities Printer = "winspool,rup" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rutserv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E rutserv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe - Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A\RMS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductName = "Remote Utilities - Host" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B382549EC85704A48B1501660D4EE98A msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\PackageCode = "C2B715477A86B9840B3BD5A0C6916BB6" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net\2 = "C:\\ProgramData\\Remote Utilities\\msi\\68001_{E945283B-758C-4A40-B851-1066D0E49EA8}\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Version = "117381777" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductIcon = "C:\\Windows\\Installer\\{E945283B-758C-4A40-B851-1066D0E49EA8}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\PackageName = "host.msi" msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3812 PING.EXE - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 2228 msiexec.exe 2228 msiexec.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 3460 rfusclient.exe 3460 rfusclient.exe - Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 2836 rfusclient.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeSecurityPrivilege 2228 msiexec.exe Token: SeCreateTokenPrivilege 2252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2252 msiexec.exe Token: SeLockMemoryPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeMachineAccountPrivilege 2252 msiexec.exe Token: SeTcbPrivilege 2252 msiexec.exe Token: SeSecurityPrivilege 2252 msiexec.exe Token: SeTakeOwnershipPrivilege 2252 msiexec.exe Token: SeLoadDriverPrivilege 2252 msiexec.exe Token: SeSystemProfilePrivilege 2252 msiexec.exe Token: SeSystemtimePrivilege 2252 msiexec.exe Token: SeProfSingleProcessPrivilege 2252 msiexec.exe Token: SeIncBasePriorityPrivilege 2252 msiexec.exe Token: SeCreatePagefilePrivilege 2252 msiexec.exe Token: SeCreatePermanentPrivilege 2252 msiexec.exe Token: SeBackupPrivilege 2252 msiexec.exe Token: SeRestorePrivilege 2252 msiexec.exe Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeDebugPrivilege 2252 msiexec.exe Token: SeAuditPrivilege 2252 msiexec.exe Token: SeSystemEnvironmentPrivilege 2252 msiexec.exe Token: SeChangeNotifyPrivilege 2252 msiexec.exe Token: SeRemoteShutdownPrivilege 2252 msiexec.exe Token: SeUndockPrivilege 2252 msiexec.exe Token: SeSyncAgentPrivilege 2252 msiexec.exe Token: SeEnableDelegationPrivilege 2252 msiexec.exe Token: SeManageVolumePrivilege 2252 msiexec.exe Token: SeImpersonatePrivilege 2252 msiexec.exe Token: SeCreateGlobalPrivilege 2252 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe Token: SeRestorePrivilege 2228 msiexec.exe Token: SeTakeOwnershipPrivilege 2228 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 784 rfusclient.exe 784 rfusclient.exe 784 rfusclient.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 784 rfusclient.exe 784 rfusclient.exe 784 rfusclient.exe - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1212 installer.exe 1212 installer.exe 1212 installer.exe 1212 installer.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 2208 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3028 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 3100 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 2748 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe 4092 rutserv.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1212 3064 15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe 68 PID 3064 wrote to memory of 1212 3064 15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe 68 PID 3064 wrote to memory of 1212 3064 15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe 68 PID 1212 wrote to memory of 2252 1212 installer.exe 69 PID 1212 wrote to memory of 2252 1212 installer.exe 69 PID 1212 wrote to memory of 2252 1212 installer.exe 69 PID 2228 wrote to memory of 1696 2228 msiexec.exe 72 PID 2228 wrote to memory of 1696 2228 msiexec.exe 72 PID 2228 wrote to memory of 1696 2228 msiexec.exe 72 PID 2228 wrote to memory of 2696 2228 msiexec.exe 73 PID 2228 wrote to memory of 2696 2228 msiexec.exe 73 PID 2228 wrote to memory of 2696 2228 msiexec.exe 73 PID 2228 wrote to memory of 2208 2228 msiexec.exe 74 PID 2228 wrote to memory of 2208 2228 msiexec.exe 74 PID 2228 wrote to memory of 2208 2228 msiexec.exe 74 PID 2228 wrote to memory of 3028 2228 msiexec.exe 75 PID 2228 wrote to memory of 3028 2228 msiexec.exe 75 PID 2228 wrote to memory of 3028 2228 msiexec.exe 75 PID 2228 wrote to memory of 3100 2228 msiexec.exe 76 PID 2228 wrote to memory of 3100 2228 msiexec.exe 76 PID 2228 wrote to memory of 3100 2228 msiexec.exe 76 PID 3100 wrote to memory of 2372 3100 rutserv.exe 78 PID 3100 wrote to memory of 2372 3100 rutserv.exe 78 PID 3100 wrote to memory of 2372 3100 rutserv.exe 78 PID 2372 wrote to memory of 3180 2372 cmd.exe 80 PID 2372 wrote to memory of 3180 2372 cmd.exe 80 PID 2372 wrote to memory of 3812 2372 cmd.exe 81 PID 2372 wrote to memory of 3812 2372 cmd.exe 81 PID 2372 wrote to memory of 3812 2372 cmd.exe 81 PID 2372 wrote to memory of 3156 2372 cmd.exe 82 PID 2372 wrote to memory of 3156 2372 cmd.exe 82 PID 2372 wrote to memory of 1248 2372 cmd.exe 83 PID 2372 wrote to memory of 1248 2372 cmd.exe 83 PID 3100 wrote to memory of 3796 3100 rutserv.exe 84 PID 3100 wrote to memory of 3796 3100 rutserv.exe 84 PID 3100 wrote to memory of 3796 3100 rutserv.exe 84 PID 3796 wrote to memory of 4020 3796 cmd.exe 86 PID 3796 wrote to memory of 4020 3796 cmd.exe 86 PID 3796 wrote to memory of 3156 3796 cmd.exe 92 PID 3796 wrote to memory of 3156 3796 cmd.exe 92 PID 3796 wrote to memory of 3860 3796 cmd.exe 95 PID 3796 wrote to memory of 3860 3796 cmd.exe 95 PID 2228 wrote to memory of 2748 2228 msiexec.exe 96 PID 2228 wrote to memory of 2748 2228 msiexec.exe 96 PID 2228 wrote to memory of 2748 2228 msiexec.exe 96 PID 1212 wrote to memory of 492 1212 installer.exe 98 PID 1212 wrote to memory of 492 1212 installer.exe 98 PID 1212 wrote to memory of 492 1212 installer.exe 98 PID 4092 wrote to memory of 3460 4092 rutserv.exe 100 PID 4092 wrote to memory of 3460 4092 rutserv.exe 100 PID 4092 wrote to memory of 3460 4092 rutserv.exe 100 PID 4092 wrote to memory of 784 4092 rutserv.exe 101 PID 4092 wrote to memory of 784 4092 rutserv.exe 101 PID 4092 wrote to memory of 784 4092 rutserv.exe 101 PID 3460 wrote to memory of 2836 3460 rfusclient.exe 105 PID 3460 wrote to memory of 2836 3460 rfusclient.exe 105 PID 3460 wrote to memory of 2836 3460 rfusclient.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe"C:\Users\Admin\AppData\Local\Temp\15174f157c0cd19caac8caca4d3055c57279bfb93833d9c3a582d9097a0c82aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:492
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F489851112577ACC5B947785B37ED902⤵
- Loads dropped DLL
PID:1696
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi"2⤵
- Executes dropped EXE
- Checks computer location settings
PID:2696
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2208
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /printerinstall2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd" "3⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exesrvinst_x64.exe stop4⤵
- Executes dropped EXE
PID:3180
-
-
C:\Windows\SysWOW64\PING.EXEping localhost4⤵
- Runs ping.exe
PID:3812
-
-
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exesrvinst_x64.exe uninstall4⤵
- Executes dropped EXE
PID:3156
-
-
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exesetupdrv.exe uninstall4⤵
- Executes dropped EXE
PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd" "3⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exesetupdrv.exe install4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4020
-
-
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exesrvinst_x64.exe install4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3156
-
-
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exesrvinst_x64.exe start4⤵
- Executes dropped EXE
PID:3860
-
-
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2828
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4060
-
C:\Windows\VPDAgent_x64.exeC:\Windows\VPDAgent_x64.exe1⤵
- Executes dropped EXE
PID:3668
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: SetClipboardViewer
PID:2836
-
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:784
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:2752