Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 02:19
Static task
static1
Behavioral task
behavioral1
Sample
915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe
Resource
win7-20220414-en
General
-
Target
915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe
-
Size
3.9MB
-
MD5
80df2f0d4da5e61f4341c4d971170395
-
SHA1
4246048db2e697a05f8dc252e3cb60f7ce83832a
-
SHA256
915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b
-
SHA512
8a78824845d3b5f235028dd19107a6a9469f5f1bb4b18d7e41e54e6aff1d76157e0866c1cdb6d0d46029bca4307afc501a50f04d03926902ff96d8ca44acf069
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Program Files (x86)\System\vp8decoder.dll acprotect C:\Program Files (x86)\System\vp8encoder.dll acprotect -
Processes:
resource yara_rule \Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 \Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 -
Executes dropped EXE 7 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 1808 rutserv.exe 1968 rutserv.exe 1556 rutserv.exe 1396 rutserv.exe 1016 rfusclient.exe 1984 rfusclient.exe 1860 rfusclient.exe -
Processes:
resource yara_rule C:\Program Files (x86)\System\vp8decoder.dll upx C:\Program Files (x86)\System\vp8encoder.dll upx -
Loads dropped DLL 2 IoCs
Processes:
cmd.exerutserv.exepid process 2024 cmd.exe 1396 rutserv.exe -
Drops file in Program Files directory 16 IoCs
Processes:
915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exedescription ioc process File opened for modification C:\Program Files (x86)\System\install.bat 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\rfusclient.exe 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\rutserv.exe 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\vp8decoder.dll 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\regedit.reg 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\regedit.reg 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\rutserv.exe 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\vp8decoder.dll 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\rfusclient.exe 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\install.bat 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\install.vbs 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\install.vbs 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\vp8encoder.dll 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File opened for modification C:\Program Files (x86)\System\vp8encoder.dll 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_7074473 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1280 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1712 taskkill.exe 1956 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 360 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 1808 rutserv.exe 1808 rutserv.exe 1808 rutserv.exe 1808 rutserv.exe 1968 rutserv.exe 1968 rutserv.exe 1556 rutserv.exe 1556 rutserv.exe 1396 rutserv.exe 1396 rutserv.exe 1396 rutserv.exe 1396 rutserv.exe 1016 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 1860 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 1712 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 1808 rutserv.exe Token: SeDebugPrivilege 1556 rutserv.exe Token: SeTakeOwnershipPrivilege 1396 rutserv.exe Token: SeTcbPrivilege 1396 rutserv.exe Token: SeTcbPrivilege 1396 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 1808 rutserv.exe 1968 rutserv.exe 1556 rutserv.exe 1396 rutserv.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exeWScript.execmd.exerutserv.exerfusclient.exedescription pid process target process PID 736 wrote to memory of 1868 736 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe WScript.exe PID 736 wrote to memory of 1868 736 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe WScript.exe PID 736 wrote to memory of 1868 736 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe WScript.exe PID 736 wrote to memory of 1868 736 915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe WScript.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 1868 wrote to memory of 2024 1868 WScript.exe cmd.exe PID 2024 wrote to memory of 1712 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1712 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1712 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1712 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1956 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1956 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1956 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1956 2024 cmd.exe taskkill.exe PID 2024 wrote to memory of 1740 2024 cmd.exe reg.exe PID 2024 wrote to memory of 1740 2024 cmd.exe reg.exe PID 2024 wrote to memory of 1740 2024 cmd.exe reg.exe PID 2024 wrote to memory of 1740 2024 cmd.exe reg.exe PID 2024 wrote to memory of 360 2024 cmd.exe regedit.exe PID 2024 wrote to memory of 360 2024 cmd.exe regedit.exe PID 2024 wrote to memory of 360 2024 cmd.exe regedit.exe PID 2024 wrote to memory of 360 2024 cmd.exe regedit.exe PID 2024 wrote to memory of 1280 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1280 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1280 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1280 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1808 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1808 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1808 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1808 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1968 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1968 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1968 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1968 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1556 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1556 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1556 2024 cmd.exe rutserv.exe PID 2024 wrote to memory of 1556 2024 cmd.exe rutserv.exe PID 1396 wrote to memory of 1016 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1016 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1016 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1016 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1984 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1984 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1984 1396 rutserv.exe rfusclient.exe PID 1396 wrote to memory of 1984 1396 rutserv.exe rfusclient.exe PID 1016 wrote to memory of 1860 1016 rfusclient.exe rfusclient.exe PID 1016 wrote to memory of 1860 1016 rfusclient.exe rfusclient.exe PID 1016 wrote to memory of 1860 1016 rfusclient.exe rfusclient.exe PID 1016 wrote to memory of 1860 1016 rfusclient.exe rfusclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe"C:\Users\Admin\AppData\Local\Temp\915738e4e4df8462f006d169a1cdebc3f311f7250b794281f78fa24d90586e4b.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\System\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:1740
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:360 -
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1280 -
C:\Program Files (x86)\System\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1808 -
C:\Program Files (x86)\System\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1968 -
C:\Program Files (x86)\System\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1556
-
C:\Program Files (x86)\System\rutserv.exe"C:\Program Files (x86)\System\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1860 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1984
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD599db27d776e103cad354b531ee1f20b9
SHA10b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69
-
Filesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
Filesize
11KB
MD5e07d9ed7f410a5b1ee9b9d790c21dccd
SHA1bf6b1a88220c78f6502399c6ddbcc30fa21a880c
SHA25684bb424fe3412a9bff5284101e7dd0ee615a33094c4f404062e25f97fbac5d26
SHA512699eafb0cffa275b4d72a3356bd2c163e418ad961f5448b91deb809eb147691be29d4d468b295cbb08f0ca21e8c9999fa185ffe2682c5b35317ab7827f8a083c
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0