Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14/07/2022, 18:21

General

  • Target

    99fdd1d682a0c2999731ad61b2c0cc2e.exe

  • Size

    16.5MB

  • MD5

    99fdd1d682a0c2999731ad61b2c0cc2e

  • SHA1

    b575cf708602d0285e97071dc7bee8daef415832

  • SHA256

    cf5da5a9b8b16d91c32b99d0379ff6729b42606ff38fee944b19e44977c8f2ea

  • SHA512

    24a5542741d1532e3616e8d74af884e0a195756c2c308fada9cc6778a8b4593579dd8a31b3d7dc915ff1385d1b2faadc1b82cae8e3e69f07ac52731b701f586b

Score
10/10

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99fdd1d682a0c2999731ad61b2c0cc2e.exe
    "C:\Users\Admin\AppData\Local\Temp\99fdd1d682a0c2999731ad61b2c0cc2e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe" -run_agent
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe" -run_agent
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2528
        • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe
          "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe" -run_agent -second
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe
            "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe" /tray /user
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4928
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\branding.ini

    Filesize

    346B

    MD5

    69a408a0d34d7725713d4b577e35e2c9

    SHA1

    827b1ab17ec12162ddb899e8dc8f1ebbcbcd3ae6

    SHA256

    c68381c19667bc42dd4ac63432e5b8faa8ead71432afce8adde0c5d918792d6f

    SHA512

    3541723da4a744274ddc5c9fce5445a3d41bd5ebbdbc2e04bc68440d5165c481b858cd2a9e3feaadc0930a0e96905615e87cb8468cd78e4119303bad7f959672

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\eventmsg.dll

    Filesize

    51KB

    MD5

    ca8a4346b37cdd0220792885c5937b30

    SHA1

    eef05f4b7fb5f8aabfb93d10a6451cc77b489864

    SHA256

    ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745

    SHA512

    c286b0fa9d24a85fe63d3a3d801f135d12409736742c4fc16ba1dc15529df136577dc8975736146437dd56467576fdedb4ac50cf05ab054547504f3dc5ca0c35

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\libeay32.dll

    Filesize

    1.3MB

    MD5

    0d51927274281007657c7f3e0df7becb

    SHA1

    6de3746d9d0980f5715cec6c676a8eb53b5efc49

    SHA256

    dfc847405be60c29e86e3e3222e7f63c1ff584727d87d3c35c25c4893e19fda0

    SHA512

    eef74088a94635184192d82bb6dcc0758749cb290c8deeff211881e8a280aec73a53334eff8846df618204b0f318e757eab23e76951a472ba6e086905000d9a5

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\libeay32.dll

    Filesize

    1.3MB

    MD5

    0d51927274281007657c7f3e0df7becb

    SHA1

    6de3746d9d0980f5715cec6c676a8eb53b5efc49

    SHA256

    dfc847405be60c29e86e3e3222e7f63c1ff584727d87d3c35c25c4893e19fda0

    SHA512

    eef74088a94635184192d82bb6dcc0758749cb290c8deeff211881e8a280aec73a53334eff8846df618204b0f318e757eab23e76951a472ba6e086905000d9a5

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\libeay32.dll

    Filesize

    1.3MB

    MD5

    0d51927274281007657c7f3e0df7becb

    SHA1

    6de3746d9d0980f5715cec6c676a8eb53b5efc49

    SHA256

    dfc847405be60c29e86e3e3222e7f63c1ff584727d87d3c35c25c4893e19fda0

    SHA512

    eef74088a94635184192d82bb6dcc0758749cb290c8deeff211881e8a280aec73a53334eff8846df618204b0f318e757eab23e76951a472ba6e086905000d9a5

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\logo.png

    Filesize

    123KB

    MD5

    e690d7d3cfb42ab03ae3d3b446b1281b

    SHA1

    bc3d54bd6dc1f4ac7f844c50235459517a884445

    SHA256

    5d988917c64bfebeed76de8777b6b717218eee09df432f6a6a86b1275836fe1d

    SHA512

    6329fe25ffbe32112e755df7f632ea32ef377b281c69b2131bb5b2720e4ce2f3777e02703e2eb78719a2f977dcd8de298e97943e1ec442b2af11c46134ba758b

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe

    Filesize

    11.2MB

    MD5

    43cc976800c506662c325478eb8bf9ea

    SHA1

    6d18795469c3a0ac6e4b8bb0024fffba51c45c60

    SHA256

    41ea3c0b8421ebdea1eb6a508a38e120b1fbb38b9a2e1379deabc5a167a87408

    SHA512

    396a97698a815316b1bd1b927f089c1d4934ea9fb8b31be72941e46030059978f98866cc19c5daf36722d5a768af007434c875de53b3f3ab9497b6a2bcd9dd54

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe

    Filesize

    11.2MB

    MD5

    43cc976800c506662c325478eb8bf9ea

    SHA1

    6d18795469c3a0ac6e4b8bb0024fffba51c45c60

    SHA256

    41ea3c0b8421ebdea1eb6a508a38e120b1fbb38b9a2e1379deabc5a167a87408

    SHA512

    396a97698a815316b1bd1b927f089c1d4934ea9fb8b31be72941e46030059978f98866cc19c5daf36722d5a768af007434c875de53b3f3ab9497b6a2bcd9dd54

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rfusclient.exe

    Filesize

    11.2MB

    MD5

    43cc976800c506662c325478eb8bf9ea

    SHA1

    6d18795469c3a0ac6e4b8bb0024fffba51c45c60

    SHA256

    41ea3c0b8421ebdea1eb6a508a38e120b1fbb38b9a2e1379deabc5a167a87408

    SHA512

    396a97698a815316b1bd1b927f089c1d4934ea9fb8b31be72941e46030059978f98866cc19c5daf36722d5a768af007434c875de53b3f3ab9497b6a2bcd9dd54

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe

    Filesize

    18.0MB

    MD5

    6c6ba57be4b7b2fb661a99fea872f6b8

    SHA1

    aa95f1662a80e2c31fc24e60a9168b6df93c42e7

    SHA256

    ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78

    SHA512

    15d89d9b89bf585acef483212c3e0cd37ee5c680e03d5e4e9f6ae73e058e5ece0ff6e52df36f695a2aed20c5115e1b1ab6eb6afa580e7349d4871ad4c079c37f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe

    Filesize

    18.0MB

    MD5

    6c6ba57be4b7b2fb661a99fea872f6b8

    SHA1

    aa95f1662a80e2c31fc24e60a9168b6df93c42e7

    SHA256

    ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78

    SHA512

    15d89d9b89bf585acef483212c3e0cd37ee5c680e03d5e4e9f6ae73e058e5ece0ff6e52df36f695a2aed20c5115e1b1ab6eb6afa580e7349d4871ad4c079c37f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\rutserv.exe

    Filesize

    18.0MB

    MD5

    6c6ba57be4b7b2fb661a99fea872f6b8

    SHA1

    aa95f1662a80e2c31fc24e60a9168b6df93c42e7

    SHA256

    ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78

    SHA512

    15d89d9b89bf585acef483212c3e0cd37ee5c680e03d5e4e9f6ae73e058e5ece0ff6e52df36f695a2aed20c5115e1b1ab6eb6afa580e7349d4871ad4c079c37f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\settings.dat

    Filesize

    8KB

    MD5

    6d2e4fa591f77a9e1ccfc0c9d4a65d90

    SHA1

    c5eddab3a3f34fd04d068f3f1e512e9bd31f3d4b

    SHA256

    06fb225e0cd52f99958336026ce1ddd4e74826b98b6d709262c832769c6cd256

    SHA512

    c06898c2affc7f1efe6d21019e282d319635e39f15e7e812b99ba650014ff24c6745e9c8a43d632b534ac491aa84baf6804b30a0c68d2c562a86d3a504df9231

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\ssleay32.dll

    Filesize

    337KB

    MD5

    197da919e4c91125656bf905877c9b5a

    SHA1

    9574ec3e87bb0f7acce72d4d59d176296741aa83

    SHA256

    303c78aba3b776472c245f17020f9aa5a53f09a6f6c1e4f34b8e18e33906b5ee

    SHA512

    33c1b853181f83cab2f57f47fb7e093badf83963613e7328ebd23f0d62f59416d7a93063c6237435fbb6833a69bc44ebbc13aa585da010f491c680b2ea335c47

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\ssleay32.dll

    Filesize

    337KB

    MD5

    197da919e4c91125656bf905877c9b5a

    SHA1

    9574ec3e87bb0f7acce72d4d59d176296741aa83

    SHA256

    303c78aba3b776472c245f17020f9aa5a53f09a6f6c1e4f34b8e18e33906b5ee

    SHA512

    33c1b853181f83cab2f57f47fb7e093badf83963613e7328ebd23f0d62f59416d7a93063c6237435fbb6833a69bc44ebbc13aa585da010f491c680b2ea335c47

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\ssleay32.dll

    Filesize

    337KB

    MD5

    197da919e4c91125656bf905877c9b5a

    SHA1

    9574ec3e87bb0f7acce72d4d59d176296741aa83

    SHA256

    303c78aba3b776472c245f17020f9aa5a53f09a6f6c1e4f34b8e18e33906b5ee

    SHA512

    33c1b853181f83cab2f57f47fb7e093badf83963613e7328ebd23f0d62f59416d7a93063c6237435fbb6833a69bc44ebbc13aa585da010f491c680b2ea335c47

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\vp8decoder.dll

    Filesize

    380KB

    MD5

    41acd8b6d9d80a61f2f686850e3d676a

    SHA1

    38428a08915cf72dd2eca25b3d87613d9aa027dd

    SHA256

    36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7

    SHA512

    d174638965ec781cbcb2927ceafb295c3176dc78da8938467faca3e512a42fe71a9dc1070f23e1c95f0b7c157fff3b00a8b572c39e4670713564f1310360ed23

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\vp8encoder.dll

    Filesize

    1.6MB

    MD5

    2ac39d6990170ca37a735f2f15f970e8

    SHA1

    8148a9cdc6b3fe6492281ebad79636433a6064ab

    SHA256

    0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa

    SHA512

    7e30fde909d5f8efd6c2e40e125525697267273163ac35cf53561a2bd32e5dad8e4fba32905f53e422c9c73b8ad9a0c151f8d36042c5f156b50bf42dc21a9cee

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\webmmux.dll

    Filesize

    260KB

    MD5

    8a683f90a78778fba037565588a6f752

    SHA1

    011939c1fa7b73272db340c32386a13e140adc6a

    SHA256

    bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d

    SHA512

    9280fbb121f8b94f57560d1be3bcfe5e7c308d54dac278f13ea6c00256444fb9f17f543dd0d32c9844460818c1a50d83b26ce51c79698e9ca7a304652a3f5ea9

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\webmvorbisdecoder.dll

    Filesize

    365KB

    MD5

    c9d412c1d30abb9d61151a10371f4140

    SHA1

    87120faa6b859f5e23f7344f9547b2fc228af15b

    SHA256

    f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e

    SHA512

    1c020afa89cdae55f4dcb80a455dc1b352f40455142f3947ed29c3e3d51fbd465b6e0ea16cd103186c252783a3f2a7f7c417e4df5727d9b2db511b650308face

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\D849A63F22\webmvorbisencoder.dll

    Filesize

    860KB

    MD5

    a59f69797c42324540e26c7c7998c18c

    SHA1

    7f7bc5bc62a8744f87a7d2e30cc6dd74c72e19b4

    SHA256

    83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1

    SHA512

    837f244e6b70658974506ac35bd3ee2d413b89fe4b26e75f4a61cc7bec63e999c9c2cffb690ad567f74962bab13f2f5471300cd0e0cfe61bb1084072cb55c38b

  • memory/3168-130-0x0000000000400000-0x000000000285B000-memory.dmp

    Filesize

    36.4MB

  • memory/3168-135-0x0000000000400000-0x000000000285B000-memory.dmp

    Filesize

    36.4MB