Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2023, 15:47

Errors

Reason
Machine shutdown

General

  • Target

    agent-7.1.7.0.exe

  • Size

    17.1MB

  • MD5

    254e7d77f5a53bd4094885703d2cf85e

  • SHA1

    36dd3760caec9f0f3caee51709668e7f575c759e

  • SHA256

    9c1228a391859ca63161ace42cc9b9024df443529828a89311dc9b675e3a916e

  • SHA512

    4790d86f8d389bb578e8edc08bd5ee60d5dfd7c13fc1da96ae3c575ec1c536fc664edf2e5126777a95813723e0260c79691ca63911144322b1baf87e7c851541

  • SSDEEP

    393216:g4wcVTVM9WdAtO2X8T5M89qkfNRIjd6FsqN/OyBnuvH6p0:BwK9dAt58ThqppU/O2wH5

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 61 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\agent-7.1.7.0.exe
    "C:\Users\Admin\AppData\Local\Temp\agent-7.1.7.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe" -run_agent
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe" -run_agent
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2152
        • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe
          "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe" -run_agent -second
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe
            "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe" /tray /user
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4620
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa39a1055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\eventmsg.dll

    Filesize

    51KB

    MD5

    ca8a4346b37cdd0220792885c5937b30

    SHA1

    eef05f4b7fb5f8aabfb93d10a6451cc77b489864

    SHA256

    ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745

    SHA512

    c286b0fa9d24a85fe63d3a3d801f135d12409736742c4fc16ba1dc15529df136577dc8975736146437dd56467576fdedb4ac50cf05ab054547504f3dc5ca0c35

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\libeay32.dll

    Filesize

    1.3MB

    MD5

    d9871a6ba02aacf3d51e6c168d9c6066

    SHA1

    42012a0116a9e8aed16c7298bd43cb1206a0f0cd

    SHA256

    7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95

    SHA512

    ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\libeay32.dll

    Filesize

    1.3MB

    MD5

    d9871a6ba02aacf3d51e6c168d9c6066

    SHA1

    42012a0116a9e8aed16c7298bd43cb1206a0f0cd

    SHA256

    7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95

    SHA512

    ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\libeay32.dll

    Filesize

    1.3MB

    MD5

    d9871a6ba02aacf3d51e6c168d9c6066

    SHA1

    42012a0116a9e8aed16c7298bd43cb1206a0f0cd

    SHA256

    7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95

    SHA512

    ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe

    Filesize

    10.4MB

    MD5

    68a63168426f28bc06c7c06eac6f09d5

    SHA1

    ae947e6b9b3322f7837396f606e64b0f372fa78c

    SHA256

    02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40

    SHA512

    7beabe39242237dd19606392bb7970f2eea0e8d467ee42a10e8ad3608e9b6a6aa060e4cd112fce425677dcc33ea062c6224574599351e81060c348409eeb11a6

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe

    Filesize

    10.4MB

    MD5

    68a63168426f28bc06c7c06eac6f09d5

    SHA1

    ae947e6b9b3322f7837396f606e64b0f372fa78c

    SHA256

    02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40

    SHA512

    7beabe39242237dd19606392bb7970f2eea0e8d467ee42a10e8ad3608e9b6a6aa060e4cd112fce425677dcc33ea062c6224574599351e81060c348409eeb11a6

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rfusclient.exe

    Filesize

    10.4MB

    MD5

    68a63168426f28bc06c7c06eac6f09d5

    SHA1

    ae947e6b9b3322f7837396f606e64b0f372fa78c

    SHA256

    02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40

    SHA512

    7beabe39242237dd19606392bb7970f2eea0e8d467ee42a10e8ad3608e9b6a6aa060e4cd112fce425677dcc33ea062c6224574599351e81060c348409eeb11a6

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe

    Filesize

    19.8MB

    MD5

    31c0bafc3f6e6c7322a7a32ac1bd87da

    SHA1

    42fd1a41e1eef5998de674ec068c702f1ee3b4f3

    SHA256

    f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5

    SHA512

    ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe

    Filesize

    19.8MB

    MD5

    31c0bafc3f6e6c7322a7a32ac1bd87da

    SHA1

    42fd1a41e1eef5998de674ec068c702f1ee3b4f3

    SHA256

    f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5

    SHA512

    ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\rutserv.exe

    Filesize

    19.8MB

    MD5

    31c0bafc3f6e6c7322a7a32ac1bd87da

    SHA1

    42fd1a41e1eef5998de674ec068c702f1ee3b4f3

    SHA256

    f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5

    SHA512

    ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\ssleay32.dll

    Filesize

    337KB

    MD5

    fe6d8feaeae983513e0a9a223604041b

    SHA1

    efa54892735d331a24b707068040e5a697455cee

    SHA256

    af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0

    SHA512

    a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\ssleay32.dll

    Filesize

    337KB

    MD5

    fe6d8feaeae983513e0a9a223604041b

    SHA1

    efa54892735d331a24b707068040e5a697455cee

    SHA256

    af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0

    SHA512

    a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\ssleay32.dll

    Filesize

    337KB

    MD5

    fe6d8feaeae983513e0a9a223604041b

    SHA1

    efa54892735d331a24b707068040e5a697455cee

    SHA256

    af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0

    SHA512

    a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\vp8decoder.dll

    Filesize

    380KB

    MD5

    41acd8b6d9d80a61f2f686850e3d676a

    SHA1

    38428a08915cf72dd2eca25b3d87613d9aa027dd

    SHA256

    36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7

    SHA512

    d174638965ec781cbcb2927ceafb295c3176dc78da8938467faca3e512a42fe71a9dc1070f23e1c95f0b7c157fff3b00a8b572c39e4670713564f1310360ed23

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\vp8encoder.dll

    Filesize

    1.6MB

    MD5

    2ac39d6990170ca37a735f2f15f970e8

    SHA1

    8148a9cdc6b3fe6492281ebad79636433a6064ab

    SHA256

    0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa

    SHA512

    7e30fde909d5f8efd6c2e40e125525697267273163ac35cf53561a2bd32e5dad8e4fba32905f53e422c9c73b8ad9a0c151f8d36042c5f156b50bf42dc21a9cee

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\webmmux.dll

    Filesize

    260KB

    MD5

    8a683f90a78778fba037565588a6f752

    SHA1

    011939c1fa7b73272db340c32386a13e140adc6a

    SHA256

    bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d

    SHA512

    9280fbb121f8b94f57560d1be3bcfe5e7c308d54dac278f13ea6c00256444fb9f17f543dd0d32c9844460818c1a50d83b26ce51c79698e9ca7a304652a3f5ea9

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\webmvorbisdecoder.dll

    Filesize

    365KB

    MD5

    c9d412c1d30abb9d61151a10371f4140

    SHA1

    87120faa6b859f5e23f7344f9547b2fc228af15b

    SHA256

    f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e

    SHA512

    1c020afa89cdae55f4dcb80a455dc1b352f40455142f3947ed29c3e3d51fbd465b6e0ea16cd103186c252783a3f2a7f7c417e4df5727d9b2db511b650308face

  • C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70170\43F629E616\webmvorbisencoder.dll

    Filesize

    860KB

    MD5

    a59f69797c42324540e26c7c7998c18c

    SHA1

    7f7bc5bc62a8744f87a7d2e30cc6dd74c72e19b4

    SHA256

    83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1

    SHA512

    837f244e6b70658974506ac35bd3ee2d413b89fe4b26e75f4a61cc7bec63e999c9c2cffb690ad567f74962bab13f2f5471300cd0e0cfe61bb1084072cb55c38b

  • memory/1900-132-0x0000000000400000-0x000000000296D000-memory.dmp

    Filesize

    37.4MB

  • memory/1900-136-0x0000000000400000-0x000000000296D000-memory.dmp

    Filesize

    37.4MB