Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2024 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
windows7-x64
16 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
8.3MB
-
MD5
73f351beae5c881fafe36f42cde9a47c
-
SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b
-
SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
-
SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66
-
SSDEEP
196608:PdQ5Lq4eAGPJgBDpKLtW0tzHlYd3cvF8m9k/RRZpAp2FG0c+imhtO:P2VqyC8mQ0vxN79kpR40cUO
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exeinstaller.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation installer.exe -
Executes dropped EXE 8 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid Process 3748 installer.exe 2812 rutserv.exe 2016 rutserv.exe 1472 rutserv.exe 4224 rutserv.exe 4296 rfusclient.exe 4264 rfusclient.exe 1768 rfusclient.exe -
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 944 MsiExec.exe -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid Process 21 1916 msiexec.exe 31 1916 msiexec.exe 34 1916 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Program Files directory 53 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\e575767.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI69E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6978.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{D9E14363-FD66-419D-9DC9-C62471755C9F} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\Installer\e575767.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e57576b.msi msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Modifies registry class 24 IoCs
Processes:
msiexec.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
installer.exemsiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid Process 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 3748 installer.exe 1916 msiexec.exe 1916 msiexec.exe 2812 rutserv.exe 2812 rutserv.exe 2812 rutserv.exe 2812 rutserv.exe 2812 rutserv.exe 2812 rutserv.exe 2016 rutserv.exe 2016 rutserv.exe 1472 rutserv.exe 1472 rutserv.exe 4224 rutserv.exe 4224 rutserv.exe 4224 rutserv.exe 4224 rutserv.exe 4224 rutserv.exe 4224 rutserv.exe 4296 rfusclient.exe 4296 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid Process 1768 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 440 msiexec.exe Token: SeIncreaseQuotaPrivilege 440 msiexec.exe Token: SeSecurityPrivilege 1916 msiexec.exe Token: SeCreateTokenPrivilege 440 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 440 msiexec.exe Token: SeLockMemoryPrivilege 440 msiexec.exe Token: SeIncreaseQuotaPrivilege 440 msiexec.exe Token: SeMachineAccountPrivilege 440 msiexec.exe Token: SeTcbPrivilege 440 msiexec.exe Token: SeSecurityPrivilege 440 msiexec.exe Token: SeTakeOwnershipPrivilege 440 msiexec.exe Token: SeLoadDriverPrivilege 440 msiexec.exe Token: SeSystemProfilePrivilege 440 msiexec.exe Token: SeSystemtimePrivilege 440 msiexec.exe Token: SeProfSingleProcessPrivilege 440 msiexec.exe Token: SeIncBasePriorityPrivilege 440 msiexec.exe Token: SeCreatePagefilePrivilege 440 msiexec.exe Token: SeCreatePermanentPrivilege 440 msiexec.exe Token: SeBackupPrivilege 440 msiexec.exe Token: SeRestorePrivilege 440 msiexec.exe Token: SeShutdownPrivilege 440 msiexec.exe Token: SeDebugPrivilege 440 msiexec.exe Token: SeAuditPrivilege 440 msiexec.exe Token: SeSystemEnvironmentPrivilege 440 msiexec.exe Token: SeChangeNotifyPrivilege 440 msiexec.exe Token: SeRemoteShutdownPrivilege 440 msiexec.exe Token: SeUndockPrivilege 440 msiexec.exe Token: SeSyncAgentPrivilege 440 msiexec.exe Token: SeEnableDelegationPrivilege 440 msiexec.exe Token: SeManageVolumePrivilege 440 msiexec.exe Token: SeImpersonatePrivilege 440 msiexec.exe Token: SeCreateGlobalPrivilege 440 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exepid Process 3748 installer.exe 2812 rutserv.exe 2016 rutserv.exe 1472 rutserv.exe 4224 rutserv.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
tmp.exeinstaller.exemsiexec.exerutserv.exerfusclient.exedescription pid Process procid_target PID 1020 wrote to memory of 3748 1020 tmp.exe 33 PID 1020 wrote to memory of 3748 1020 tmp.exe 33 PID 1020 wrote to memory of 3748 1020 tmp.exe 33 PID 3748 wrote to memory of 440 3748 installer.exe 34 PID 3748 wrote to memory of 440 3748 installer.exe 34 PID 3748 wrote to memory of 440 3748 installer.exe 34 PID 1916 wrote to memory of 944 1916 msiexec.exe 95 PID 1916 wrote to memory of 944 1916 msiexec.exe 95 PID 1916 wrote to memory of 944 1916 msiexec.exe 95 PID 1916 wrote to memory of 2812 1916 msiexec.exe 103 PID 1916 wrote to memory of 2812 1916 msiexec.exe 103 PID 1916 wrote to memory of 2812 1916 msiexec.exe 103 PID 1916 wrote to memory of 2016 1916 msiexec.exe 96 PID 1916 wrote to memory of 2016 1916 msiexec.exe 96 PID 1916 wrote to memory of 2016 1916 msiexec.exe 96 PID 1916 wrote to memory of 1472 1916 msiexec.exe 97 PID 1916 wrote to memory of 1472 1916 msiexec.exe 97 PID 1916 wrote to memory of 1472 1916 msiexec.exe 97 PID 3748 wrote to memory of 1408 3748 installer.exe 102 PID 3748 wrote to memory of 1408 3748 installer.exe 102 PID 3748 wrote to memory of 1408 3748 installer.exe 102 PID 4224 wrote to memory of 4264 4224 rutserv.exe 99 PID 4224 wrote to memory of 4264 4224 rutserv.exe 99 PID 4224 wrote to memory of 4264 4224 rutserv.exe 99 PID 4224 wrote to memory of 4296 4224 rutserv.exe 100 PID 4224 wrote to memory of 4296 4224 rutserv.exe 100 PID 4224 wrote to memory of 4296 4224 rutserv.exe 100 PID 4296 wrote to memory of 1768 4296 rfusclient.exe 108 PID 4296 wrote to memory of 1768 4296 rfusclient.exe 108 PID 4296 wrote to memory of 1768 4296 rfusclient.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:1408
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8BC9CD38A5E14B2727ACE1DF59DA14672⤵
- Loads dropped DLL
PID:944
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:4264
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5d613e46000457dc9c9ecc89054e02a64
SHA124e8aa691f3ce0a5a9fececc75867c82ed218948
SHA2561cc71a4353ec45f1db9159d0aa9a3451afa2b7d10060cdb13b61d066ba941c38
SHA5122080d4d81b320e99094ee2ad5987b2c2f1c3d5d5245699e62789cd1eabcf667b7efa57cf89337f34c586aa188adc22ab4f5dff16f667a1795b97c0d9bb109309
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
381KB
MD554c9672457bc53a01537fb3c11ab2bb9
SHA1b613273f49bf8707f503f507632e030127829192
SHA25677933c96cac495f662a0c391135da3eff1f9c38231d8f260d3a0da346106645d
SHA512b0ea9f0ce5b2d4b9170f01daec5341b242f865466822108b15916684afb4e453c61328caf69d64c1d6fdb66a4123600418760b2c12253aa1a3a6926eed5ee5d8
-
Filesize
92KB
MD5b32fdbab0310b5f9df4b5684f1869d5c
SHA1291dc93b26430eb9560eb5be8d6d149e64171e17
SHA256d6a0b0bd6846528ca3f3d505727b1eef8cd69062237b8b34378db8e1c7ece1e0
SHA512e804cea0de422ca6268842eeba87cc22a6b26feafe89ae34bc8bc1f5f82f69883ed99ecf435690d5a68a41281491b58f39c226a6df0cbba7f9634d462cdc3049