Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
23-02-2022 09:11
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
8.3MB
-
MD5
cb2ffac2a251378cda3f91cd613f453d
-
SHA1
3a028761638f5aa93b0719c5650c83a138e8abc9
-
SHA256
10165e27e0db0a6708f346ddea657ab0409499f93eb8426a80864a966f0f401e
-
SHA512
1d203540fde5074f0d57e1ecbd9af2ee862b940f8fb58c3e55ad9db5ba029aff82a4468eee24c760b5e55cc96e61244af0fd6f3c46db857824e13e45ec1e802f
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1400 msiexec.exe 5 1400 msiexec.exe 7 1400 msiexec.exe -
Executes dropped EXE 8 IoCs
pid Process 656 installer.exe 1512 rutserv.exe 984 rutserv.exe 1276 rutserv.exe 1636 rutserv.exe 1764 rfusclient.exe 1172 rfusclient.exe 1196 rfusclient.exe -
Loads dropped DLL 4 IoCs
pid Process 1908 tmp.exe 1056 MsiExec.exe 1636 rutserv.exe 1636 rutserv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f75d4eb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDEB6.tmp msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\f75d4ed.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID8FB.tmp msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\f75d4eb.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\Installer\f75d4ed.ipi msiexec.exe File created C:\Windows\Installer\f75d4ef.msi msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26 msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3.4ru_mod_mod.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 656 installer.exe 656 installer.exe 656 installer.exe 656 installer.exe 656 installer.exe 656 installer.exe 1400 msiexec.exe 1400 msiexec.exe 1512 rutserv.exe 1512 rutserv.exe 1512 rutserv.exe 1512 rutserv.exe 984 rutserv.exe 984 rutserv.exe 1276 rutserv.exe 1276 rutserv.exe 1636 rutserv.exe 1636 rutserv.exe 1636 rutserv.exe 1636 rutserv.exe 1764 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1196 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1680 msiexec.exe Token: SeIncreaseQuotaPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeSecurityPrivilege 1400 msiexec.exe Token: SeCreateTokenPrivilege 1680 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1680 msiexec.exe Token: SeLockMemoryPrivilege 1680 msiexec.exe Token: SeIncreaseQuotaPrivilege 1680 msiexec.exe Token: SeMachineAccountPrivilege 1680 msiexec.exe Token: SeTcbPrivilege 1680 msiexec.exe Token: SeSecurityPrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeLoadDriverPrivilege 1680 msiexec.exe Token: SeSystemProfilePrivilege 1680 msiexec.exe Token: SeSystemtimePrivilege 1680 msiexec.exe Token: SeProfSingleProcessPrivilege 1680 msiexec.exe Token: SeIncBasePriorityPrivilege 1680 msiexec.exe Token: SeCreatePagefilePrivilege 1680 msiexec.exe Token: SeCreatePermanentPrivilege 1680 msiexec.exe Token: SeBackupPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeShutdownPrivilege 1680 msiexec.exe Token: SeDebugPrivilege 1680 msiexec.exe Token: SeAuditPrivilege 1680 msiexec.exe Token: SeSystemEnvironmentPrivilege 1680 msiexec.exe Token: SeChangeNotifyPrivilege 1680 msiexec.exe Token: SeRemoteShutdownPrivilege 1680 msiexec.exe Token: SeUndockPrivilege 1680 msiexec.exe Token: SeSyncAgentPrivilege 1680 msiexec.exe Token: SeEnableDelegationPrivilege 1680 msiexec.exe Token: SeManageVolumePrivilege 1680 msiexec.exe Token: SeImpersonatePrivilege 1680 msiexec.exe Token: SeCreateGlobalPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 656 installer.exe 1512 rutserv.exe 984 rutserv.exe 1276 rutserv.exe 1636 rutserv.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 1908 wrote to memory of 656 1908 tmp.exe 27 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 656 wrote to memory of 1680 656 installer.exe 28 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1056 1400 msiexec.exe 30 PID 1400 wrote to memory of 1512 1400 msiexec.exe 31 PID 1400 wrote to memory of 1512 1400 msiexec.exe 31 PID 1400 wrote to memory of 1512 1400 msiexec.exe 31 PID 1400 wrote to memory of 1512 1400 msiexec.exe 31 PID 1400 wrote to memory of 984 1400 msiexec.exe 32 PID 1400 wrote to memory of 984 1400 msiexec.exe 32 PID 1400 wrote to memory of 984 1400 msiexec.exe 32 PID 1400 wrote to memory of 984 1400 msiexec.exe 32 PID 1400 wrote to memory of 1276 1400 msiexec.exe 33 PID 1400 wrote to memory of 1276 1400 msiexec.exe 33 PID 1400 wrote to memory of 1276 1400 msiexec.exe 33 PID 1400 wrote to memory of 1276 1400 msiexec.exe 33 PID 656 wrote to memory of 1044 656 installer.exe 35 PID 656 wrote to memory of 1044 656 installer.exe 35 PID 656 wrote to memory of 1044 656 installer.exe 35 PID 656 wrote to memory of 1044 656 installer.exe 35 PID 1636 wrote to memory of 1764 1636 rutserv.exe 37 PID 1636 wrote to memory of 1764 1636 rutserv.exe 37 PID 1636 wrote to memory of 1764 1636 rutserv.exe 37 PID 1636 wrote to memory of 1764 1636 rutserv.exe 37 PID 1636 wrote to memory of 1172 1636 rutserv.exe 38 PID 1636 wrote to memory of 1172 1636 rutserv.exe 38 PID 1636 wrote to memory of 1172 1636 rutserv.exe 38 PID 1636 wrote to memory of 1172 1636 rutserv.exe 38 PID 1764 wrote to memory of 1196 1764 rfusclient.exe 39 PID 1764 wrote to memory of 1196 1764 rfusclient.exe 39 PID 1764 wrote to memory of 1196 1764 rfusclient.exe 39 PID 1764 wrote to memory of 1196 1764 rfusclient.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:1044
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7E98CCFD038B2A45E53AEC0B717F1762⤵
- Loads dropped DLL
PID:1056
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:984
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1196
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1172
-