Analysis Overview
SHA256
c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6
Threat Level: Known bad
The file c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6 was found to be: Known bad.
Malicious Activity Summary
RMS
ACProtect 1.3x - 1.4x DLL software
Executes dropped EXE
UPX packed file
ASPack v2.12-2.42
Checks computer location settings
Loads dropped DLL
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Suspicious use of SetWindowsHookEx
Delays execution with timeout.exe
Runs .reg file with regedit
Kills process with taskkill
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-02 17:24
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-02 17:24
Reported
2022-05-02 18:41
Platform
win10v2004-20220414-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
RMS
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
Drops file in Program Files directory
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe | N/A |
Runs .reg file with regedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
Suspicious behavior: SetClipboardViewer
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe
"C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\program files\sony\install.vbs"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files\sony\install.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
C:\Windows\SysWOW64\regedit.exe
regedit /s "regedit.reg"
C:\Windows\SysWOW64\timeout.exe
timeout 2
\??\c:\program files\sony\rutserv.exe
rutserv.exe /silentinstall
\??\c:\program files\sony\rutserv.exe
rutserv.exe /firewall
\??\c:\program files\sony\rutserv.exe
rutserv.exe /start
\??\c:\program files\sony\rutserv.exe
"c:\program files\sony\rutserv.exe"
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe"
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe" /tray
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe" /tray
Network
| Country | Destination | Domain | Proto |
| NL | 104.110.191.140:80 | tcp | |
| US | 8.8.8.8:53 | rmansys.ru | udp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| US | 8.8.8.8:53 | rms-server.tektonit.ru | udp |
| RU | 95.213.205.83:5655 | rms-server.tektonit.ru | tcp |
| US | 20.42.65.84:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp |
Files
memory/1484-130-0x0000000000000000-mapping.dmp
C:\program files\sony\install.vbs
| MD5 | 65fc32766a238ff3e95984e325357dbb |
| SHA1 | 3ac16a2648410be8aa75f3e2817fbf69bb0e8922 |
| SHA256 | a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420 |
| SHA512 | 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608 |
C:\Program Files\sony\install.bat
| MD5 | 99db27d776e103cad354b531ee1f20b9 |
| SHA1 | 0b82d146df8528f66d1d14756f211fd3a8b1b91a |
| SHA256 | 240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3 |
| SHA512 | bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69 |
memory/4856-133-0x0000000000000000-mapping.dmp
memory/2132-134-0x0000000000000000-mapping.dmp
memory/2496-135-0x0000000000000000-mapping.dmp
memory/2544-136-0x0000000000000000-mapping.dmp
memory/4564-137-0x0000000000000000-mapping.dmp
\??\c:\program files\sony\regedit.reg
| MD5 | ad04c93f028cf8c25dfed3d02e47816e |
| SHA1 | 59211771eb7bf5186343db88562093f8f67b2e0f |
| SHA256 | 962ae13f3c26eca28fb568e055d67bb49ce37854f90fc00b3536db1e9f159860 |
| SHA512 | 563f71f13d8b97a7194656b12485152a6cf6b0fb4eb84534f9740b6521c495e37fd14a64eaaa551f041106e420fa9ab6e597362566cc99c276859c9beeb85312 |
memory/3548-139-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/948-140-0x0000000000000000-mapping.dmp
\??\c:\program files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/948-143-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/948-144-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/948-145-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/948-146-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/948-147-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/948-148-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-149-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/4788-151-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-152-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-153-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-154-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-155-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4788-156-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1124-157-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1124-159-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1124-160-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1124-161-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1124-162-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1124-163-0x0000000000400000-0x0000000000AB9000-memory.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/2084-165-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/2084-166-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/2084-167-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/2084-168-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/2084-169-0x0000000000400000-0x0000000000AB9000-memory.dmp
\??\c:\program files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
\??\c:\program files\sony\vp8encoder.dll
| MD5 | 6298c0af3d1d563834a218a9cc9f54bd |
| SHA1 | 0185cd591e454ed072e5a5077b25c612f6849dc9 |
| SHA256 | 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172 |
| SHA512 | 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe |
memory/1124-173-0x0000000000400000-0x0000000000AB9000-memory.dmp
\??\c:\program files\sony\vp8decoder.dll
| MD5 | 88318158527985702f61d169434a4940 |
| SHA1 | 3cc751ba256b5727eb0713aad6f554ff1e7bca57 |
| SHA256 | 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74 |
| SHA512 | 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff |
memory/5084-174-0x0000000000000000-mapping.dmp
memory/4296-175-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/5084-178-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4296-179-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5084-180-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4296-181-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5084-182-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4296-183-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5084-184-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4296-185-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4296-186-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5084-187-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-188-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/2476-190-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-191-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-192-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-193-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-194-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2476-195-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2084-196-0x0000000000400000-0x0000000000AB9000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-02 17:24
Reported
2022-05-02 18:41
Platform
win7-20220414-en
Max time kernel
171s
Max time network
175s
Command Line
Signatures
RMS
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
Drops file in Program Files directory
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Runs .reg file with regedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
Suspicious behavior: SetClipboardViewer
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rfusclient.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
| N/A | N/A | \??\c:\program files\sony\rutserv.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe
"C:\Users\Admin\AppData\Local\Temp\c770322a2b938abb69531118353c43aeb8f47d69a0a756434f57d65716c2deb6.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\program files\sony\install.vbs"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files\sony\install.bat" "
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
C:\Windows\SysWOW64\regedit.exe
regedit /s "regedit.reg"
C:\Windows\SysWOW64\timeout.exe
timeout 2
\??\c:\program files\sony\rutserv.exe
rutserv.exe /silentinstall
\??\c:\program files\sony\rutserv.exe
rutserv.exe /firewall
\??\c:\program files\sony\rutserv.exe
rutserv.exe /start
\??\c:\program files\sony\rutserv.exe
"c:\program files\sony\rutserv.exe"
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe"
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe" /tray
\??\c:\program files\sony\rfusclient.exe
"c:\program files\sony\rfusclient.exe" /tray
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rmansys.ru | udp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| US | 8.8.8.8:53 | rms-server.tektonit.ru | udp |
| RU | 95.213.205.83:5655 | rms-server.tektonit.ru | tcp |
Files
memory/1176-54-0x0000000075A61000-0x0000000075A63000-memory.dmp
memory/1912-55-0x0000000000000000-mapping.dmp
C:\program files\sony\install.vbs
| MD5 | 65fc32766a238ff3e95984e325357dbb |
| SHA1 | 3ac16a2648410be8aa75f3e2817fbf69bb0e8922 |
| SHA256 | a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420 |
| SHA512 | 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608 |
C:\Program Files\sony\install.bat
| MD5 | 99db27d776e103cad354b531ee1f20b9 |
| SHA1 | 0b82d146df8528f66d1d14756f211fd3a8b1b91a |
| SHA256 | 240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3 |
| SHA512 | bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69 |
memory/1340-59-0x0000000000000000-mapping.dmp
memory/2040-60-0x0000000000000000-mapping.dmp
memory/1332-61-0x0000000000000000-mapping.dmp
memory/1180-62-0x0000000000000000-mapping.dmp
memory/1796-63-0x0000000000000000-mapping.dmp
\??\c:\program files\sony\regedit.reg
| MD5 | ad04c93f028cf8c25dfed3d02e47816e |
| SHA1 | 59211771eb7bf5186343db88562093f8f67b2e0f |
| SHA256 | 962ae13f3c26eca28fb568e055d67bb49ce37854f90fc00b3536db1e9f159860 |
| SHA512 | 563f71f13d8b97a7194656b12485152a6cf6b0fb4eb84534f9740b6521c495e37fd14a64eaaa551f041106e420fa9ab6e597362566cc99c276859c9beeb85312 |
memory/580-66-0x0000000000000000-mapping.dmp
\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/840-69-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
\??\c:\program files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/840-72-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/840-73-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/840-74-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/840-75-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/840-76-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/840-77-0x0000000000400000-0x0000000000AB9000-memory.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/820-78-0x0000000000000000-mapping.dmp
memory/820-82-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/820-81-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/820-83-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/820-84-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/820-85-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/820-86-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1804-87-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1804-90-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1804-91-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1804-92-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1804-93-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1804-94-0x0000000000400000-0x0000000000AB9000-memory.dmp
C:\Program Files\sony\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/524-97-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/524-98-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/524-100-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/524-99-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/524-101-0x0000000000400000-0x0000000000AB9000-memory.dmp
\??\c:\program files\sony\vp8decoder.dll
| MD5 | 88318158527985702f61d169434a4940 |
| SHA1 | 3cc751ba256b5727eb0713aad6f554ff1e7bca57 |
| SHA256 | 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74 |
| SHA512 | 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff |
\??\c:\program files\sony\vp8encoder.dll
| MD5 | 6298c0af3d1d563834a218a9cc9f54bd |
| SHA1 | 0185cd591e454ed072e5a5077b25c612f6849dc9 |
| SHA256 | 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172 |
| SHA512 | 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe |
\??\c:\program files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/964-107-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/1132-106-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/1804-110-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1132-113-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/964-114-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1132-115-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/964-117-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1132-116-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/964-118-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1132-119-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1132-121-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/964-122-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/964-120-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1996-123-0x0000000000000000-mapping.dmp
C:\Program Files\sony\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/1996-131-0x0000000000400000-0x00000000009B6000-memory.dmp