Analysis
-
max time kernel
35s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
-
Size
4.0MB
-
MD5
acf3ffe4ef28ee077026078d3aef11be
-
SHA1
3e349d572a82b1df3bd61970640aa50ef6bbed78
-
SHA256
cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29
-
SHA512
00715f0162e8490a743eb307be942373528347e5b9cdfa92b5ab63c16d03ebac2a3925b54e40ad3e7023b2b0b6f9ffb71f09d213b76b7fc7245bae24ebfd0b72
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rutserv.exepid process 1528 rutserv.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1284 cmd.exe -
Drops file in Program Files directory 15 IoCs
Processes:
cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exedescription ioc process File opened for modification C:\Program Files (x86)\rutserv.exe cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\vp8decoder.dll cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\rfusclient.exe cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\rfusclient.exe cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\regedit.reg cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\install.vbs cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\vp8encoder.dll cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\vp8encoder.dll cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\regedit.reg cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\install.vbs cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\__tmp_rar_sfx_access_check_7108887 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\install.bat cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\install.bat cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File created C:\Program Files (x86)\rutserv.exe cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe File opened for modification C:\Program Files (x86)\vp8decoder.dll cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1384 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 364 taskkill.exe 1764 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 1572 regedit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 364 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exeWScript.execmd.exedescription pid process target process PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1364 wrote to memory of 1728 1364 cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe WScript.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1728 wrote to memory of 1284 1728 WScript.exe cmd.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 364 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1764 1284 cmd.exe taskkill.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1048 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1572 1284 cmd.exe regedit.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1384 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe PID 1284 wrote to memory of 1528 1284 cmd.exe rutserv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe"C:\Users\Admin\AppData\Local\Temp\cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:1572 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:1048
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1384 -
C:\Program Files (x86)\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
PID:1528 -
C:\Program Files (x86)\rutserv.exerutserv.exe /firewall4⤵PID:2040
-
C:\Program Files (x86)\rutserv.exerutserv.exe /start4⤵PID:1260
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:364
-
C:\Program Files (x86)\rutserv.exe"C:\Program Files (x86)\rutserv.exe"1⤵PID:2012
-
C:\Program Files (x86)\rfusclient.exe"C:\Program Files (x86)\rfusclient.exe" /tray2⤵PID:2044
-
C:\Program Files (x86)\rfusclient.exe"C:\Program Files (x86)\rfusclient.exe"2⤵PID:1372
-
C:\Program Files (x86)\rfusclient.exe"C:\Program Files (x86)\rfusclient.exe" /tray3⤵PID:620