Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 02:03
Static task
static1
Behavioral task
behavioral1
Sample
bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe
Resource
win7-20220414-en
General
-
Target
bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe
-
Size
4.3MB
-
MD5
037e9f1ec832baabe53323cbd57603c6
-
SHA1
89dc1f40f9a97d73b2d5ad059a61b0a3e783cc35
-
SHA256
bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44
-
SHA512
16145105bc6ced023d143f21ed687d6c1dc92925af592e3bdb9510c77afe1abd2b7e92e24f2ab515d1189b5ff31529a60b950f0e5ce37dc309a14630a8de6c68
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00080000000122ea-103.dat acprotect behavioral1/files/0x00080000000122e9-102.dat acprotect -
resource yara_rule behavioral1/files/0x00080000000122e8-67.dat aspack_v212_v242 behavioral1/files/0x00080000000122e8-68.dat aspack_v212_v242 behavioral1/files/0x00080000000122e8-70.dat aspack_v212_v242 behavioral1/files/0x00080000000122e8-79.dat aspack_v212_v242 behavioral1/files/0x00080000000122e8-88.dat aspack_v212_v242 behavioral1/files/0x00080000000122e8-95.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-104.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-107.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-105.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-109.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-111.dat aspack_v212_v242 behavioral1/files/0x00080000000122e7-134.dat aspack_v212_v242 -
Executes dropped EXE 7 IoCs
pid Process 1552 rutserv.exe 1596 rutserv.exe 1656 rutserv.exe 1668 rutserv.exe 608 rfusclient.exe 1072 rfusclient.exe 1580 rfusclient.exe -
resource yara_rule behavioral1/files/0x00080000000122ea-103.dat upx behavioral1/files/0x00080000000122e9-102.dat upx -
Loads dropped DLL 3 IoCs
pid Process 1228 cmd.exe 1668 rutserv.exe 1668 rutserv.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\word\1.doc bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\~$1.doc WINWORD.EXE File opened for modification C:\Program Files\word bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\install.bat bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\rfusclient.exe bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\vp8decoder.dll bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\vp8decoder.dll bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\1.doc bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\__tmp_rar_sfx_access_check_7069528 bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\install.vbs bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\install.vbs bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\regedit.reg bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\rfusclient.exe bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\vp8encoder.dll bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\vp8encoder.dll bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\install.bat bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\regedit.reg bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File created C:\Program Files\word\rutserv.exe bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\rutserv.exe bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe File opened for modification C:\Program Files\word\1.doc WINWORD.EXE File opened for modification C:\Program Files\word\~$1.doc WINWORD.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
pid Process 1376 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 2044 taskkill.exe 1888 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE -
Runs .reg file with regedit 1 IoCs
pid Process 1060 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 388 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1552 rutserv.exe 1552 rutserv.exe 1552 rutserv.exe 1552 rutserv.exe 1596 rutserv.exe 1596 rutserv.exe 1656 rutserv.exe 1656 rutserv.exe 1668 rutserv.exe 1668 rutserv.exe 1668 rutserv.exe 1668 rutserv.exe 608 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1580 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2044 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 1552 rutserv.exe Token: SeDebugPrivilege 1656 rutserv.exe Token: SeTakeOwnershipPrivilege 1668 rutserv.exe Token: SeTcbPrivilege 1668 rutserv.exe Token: SeTcbPrivilege 1668 rutserv.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1552 rutserv.exe 1596 rutserv.exe 1656 rutserv.exe 1668 rutserv.exe 388 WINWORD.EXE 388 WINWORD.EXE -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1512 wrote to memory of 1940 1512 bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe 28 PID 1512 wrote to memory of 1940 1512 bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe 28 PID 1512 wrote to memory of 1940 1512 bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe 28 PID 1512 wrote to memory of 1940 1512 bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe 28 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1940 wrote to memory of 1228 1940 WScript.exe 29 PID 1228 wrote to memory of 2044 1228 cmd.exe 31 PID 1228 wrote to memory of 2044 1228 cmd.exe 31 PID 1228 wrote to memory of 2044 1228 cmd.exe 31 PID 1228 wrote to memory of 2044 1228 cmd.exe 31 PID 1228 wrote to memory of 1888 1228 cmd.exe 33 PID 1228 wrote to memory of 1888 1228 cmd.exe 33 PID 1228 wrote to memory of 1888 1228 cmd.exe 33 PID 1228 wrote to memory of 1888 1228 cmd.exe 33 PID 1228 wrote to memory of 388 1228 cmd.exe 34 PID 1228 wrote to memory of 388 1228 cmd.exe 34 PID 1228 wrote to memory of 388 1228 cmd.exe 34 PID 1228 wrote to memory of 388 1228 cmd.exe 34 PID 1228 wrote to memory of 1060 1228 cmd.exe 35 PID 1228 wrote to memory of 1060 1228 cmd.exe 35 PID 1228 wrote to memory of 1060 1228 cmd.exe 35 PID 1228 wrote to memory of 1060 1228 cmd.exe 35 PID 1228 wrote to memory of 1376 1228 cmd.exe 36 PID 1228 wrote to memory of 1376 1228 cmd.exe 36 PID 1228 wrote to memory of 1376 1228 cmd.exe 36 PID 1228 wrote to memory of 1376 1228 cmd.exe 36 PID 1228 wrote to memory of 1552 1228 cmd.exe 37 PID 1228 wrote to memory of 1552 1228 cmd.exe 37 PID 1228 wrote to memory of 1552 1228 cmd.exe 37 PID 1228 wrote to memory of 1552 1228 cmd.exe 37 PID 1228 wrote to memory of 1596 1228 cmd.exe 38 PID 1228 wrote to memory of 1596 1228 cmd.exe 38 PID 1228 wrote to memory of 1596 1228 cmd.exe 38 PID 1228 wrote to memory of 1596 1228 cmd.exe 38 PID 1228 wrote to memory of 1656 1228 cmd.exe 39 PID 1228 wrote to memory of 1656 1228 cmd.exe 39 PID 1228 wrote to memory of 1656 1228 cmd.exe 39 PID 1228 wrote to memory of 1656 1228 cmd.exe 39 PID 1668 wrote to memory of 608 1668 rutserv.exe 41 PID 1668 wrote to memory of 608 1668 rutserv.exe 41 PID 1668 wrote to memory of 608 1668 rutserv.exe 41 PID 1668 wrote to memory of 608 1668 rutserv.exe 41 PID 1668 wrote to memory of 1072 1668 rutserv.exe 42 PID 1668 wrote to memory of 1072 1668 rutserv.exe 42 PID 1668 wrote to memory of 1072 1668 rutserv.exe 42 PID 1668 wrote to memory of 1072 1668 rutserv.exe 42 PID 1228 wrote to memory of 388 1228 cmd.exe 43 PID 1228 wrote to memory of 388 1228 cmd.exe 43 PID 1228 wrote to memory of 388 1228 cmd.exe 43 PID 1228 wrote to memory of 388 1228 cmd.exe 43 PID 388 wrote to memory of 1504 388 WINWORD.EXE 44 PID 388 wrote to memory of 1504 388 WINWORD.EXE 44 PID 388 wrote to memory of 1504 388 WINWORD.EXE 44 PID 388 wrote to memory of 1504 388 WINWORD.EXE 44 PID 608 wrote to memory of 1580 608 rfusclient.exe 47 PID 608 wrote to memory of 1580 608 rfusclient.exe 47 PID 608 wrote to memory of 1580 608 rfusclient.exe 47 PID 608 wrote to memory of 1580 608 rfusclient.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe"C:\Users\Admin\AppData\Local\Temp\bc3758b4698a77d9126ad97c6bf695e2cfeb8b1ced85a948f24e7895c635ae44.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\word\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\word\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:388
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:1060
-
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1376
-
-
C:\Program Files\word\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Program Files\word\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\word\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1656
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Program Files\word\1.doc"4⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122885⤵PID:1504
-
-
-
-
-
C:\Program Files\word\rutserv.exe"C:\Program Files\word\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1580
-
-
-
C:\Program Files\word\rfusclient.exe"C:\Program Files\word\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1072
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD52d17816c1b66dd964511796c037045e5
SHA14f7199f48ed081de8a904a77ed73c65f35d15bf9
SHA2569585e54a4d46e70491c8098d9abeaeb470a12a2a45e1bfd00100d28d79df61c4
SHA5120b0c21f94ae6d4f7687a7e1fc92e182abd39da807f4465c22830d0a9425731d603c790d85481d3fbc4d6cfd34a2bb899adf02b30f30bfb0ad9bc031b51fe37be
-
Filesize
304B
MD573e89f8df08e778feca688998addfec4
SHA1a715a2dba5412da8bfd17ccff4cf931822463085
SHA2560506dec7ee56d3e967dba45fa02e410a9c79530878244c2b23e6599ec7ff6bfd
SHA512a93d30718fefc5b2dcf17f16b599f03f91fb7e8e99d9a2a7986d6138755866772446cd1c287b85c849b5505735f1d924aff534e5857a8a79e157c237f98892d2
-
Filesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
Filesize
11KB
MD57b9375d672ff35e2331439dc4bfb95a2
SHA176bef183b79906643cd95177d2f4976666ec1d76
SHA2567a1071e0068f10191ff416c9133f133d63a56de1fc3c62baa4e57e3acecd7fa6
SHA5124aee9306a57570e99de699f8f6cb6eb2541fdbcc35b036cd90dbe5e15468faa61372c68b15b09f827a5bea5cdcb6eef6107bec4120b7e23674e6d979499e8e22
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0