Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
windows7-x64
16 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
8.3MB
-
MD5
73f351beae5c881fafe36f42cde9a47c
-
SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b
-
SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
-
SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66
-
SSDEEP
196608:PdQ5Lq4eAGPJgBDpKLtW0tzHlYd3cvF8m9k/RRZpAp2FG0c+imhtO:P2VqyC8mQ0vxN79kpR40cUO
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exeinstaller.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation installer.exe -
Executes dropped EXE 8 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid Process 4052 installer.exe 4604 rutserv.exe 396 rutserv.exe 5020 rutserv.exe 1244 rutserv.exe 896 rfusclient.exe 808 rfusclient.exe 2088 rfusclient.exe -
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 1392 MsiExec.exe -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid Process 21 3812 msiexec.exe 27 3812 msiexec.exe 29 3812 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Program Files directory 53 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\Installer\e57610c.msi msiexec.exe File created C:\Windows\Installer\e576110.msi msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI641A.tmp msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\e57610c.msi msiexec.exe File created C:\Windows\Installer\SourceHash{D9E14363-FD66-419D-9DC9-C62471755C9F} msiexec.exe File opened for modification C:\Windows\Installer\MSI638C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Modifies registry class 24 IoCs
Processes:
msiexec.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
installer.exemsiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid Process 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 4052 installer.exe 3812 msiexec.exe 3812 msiexec.exe 4604 rutserv.exe 4604 rutserv.exe 4604 rutserv.exe 4604 rutserv.exe 4604 rutserv.exe 4604 rutserv.exe 396 rutserv.exe 396 rutserv.exe 5020 rutserv.exe 5020 rutserv.exe 1244 rutserv.exe 1244 rutserv.exe 1244 rutserv.exe 1244 rutserv.exe 1244 rutserv.exe 1244 rutserv.exe 896 rfusclient.exe 896 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid Process 2088 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
backgroundTaskHost.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 3092 backgroundTaskHost.exe Token: SeIncreaseQuotaPrivilege 3092 backgroundTaskHost.exe Token: SeSecurityPrivilege 3812 msiexec.exe Token: SeCreateTokenPrivilege 3092 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3092 backgroundTaskHost.exe Token: SeLockMemoryPrivilege 3092 backgroundTaskHost.exe Token: SeIncreaseQuotaPrivilege 3092 backgroundTaskHost.exe Token: SeMachineAccountPrivilege 3092 backgroundTaskHost.exe Token: SeTcbPrivilege 3092 backgroundTaskHost.exe Token: SeSecurityPrivilege 3092 backgroundTaskHost.exe Token: SeTakeOwnershipPrivilege 3092 backgroundTaskHost.exe Token: SeLoadDriverPrivilege 3092 backgroundTaskHost.exe Token: SeSystemProfilePrivilege 3092 backgroundTaskHost.exe Token: SeSystemtimePrivilege 3092 backgroundTaskHost.exe Token: SeProfSingleProcessPrivilege 3092 backgroundTaskHost.exe Token: SeIncBasePriorityPrivilege 3092 backgroundTaskHost.exe Token: SeCreatePagefilePrivilege 3092 backgroundTaskHost.exe Token: SeCreatePermanentPrivilege 3092 backgroundTaskHost.exe Token: SeBackupPrivilege 3092 backgroundTaskHost.exe Token: SeRestorePrivilege 3092 backgroundTaskHost.exe Token: SeShutdownPrivilege 3092 backgroundTaskHost.exe Token: SeDebugPrivilege 3092 backgroundTaskHost.exe Token: SeAuditPrivilege 3092 backgroundTaskHost.exe Token: SeSystemEnvironmentPrivilege 3092 backgroundTaskHost.exe Token: SeChangeNotifyPrivilege 3092 backgroundTaskHost.exe Token: SeRemoteShutdownPrivilege 3092 backgroundTaskHost.exe Token: SeUndockPrivilege 3092 backgroundTaskHost.exe Token: SeSyncAgentPrivilege 3092 backgroundTaskHost.exe Token: SeEnableDelegationPrivilege 3092 backgroundTaskHost.exe Token: SeManageVolumePrivilege 3092 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3092 backgroundTaskHost.exe Token: SeCreateGlobalPrivilege 3092 backgroundTaskHost.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe Token: SeRestorePrivilege 3812 msiexec.exe Token: SeTakeOwnershipPrivilege 3812 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exepid Process 4052 installer.exe 4604 rutserv.exe 396 rutserv.exe 5020 rutserv.exe 1244 rutserv.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
tmp.exeinstaller.exemsiexec.exerutserv.exerfusclient.exedescription pid Process procid_target PID 4048 wrote to memory of 4052 4048 tmp.exe 95 PID 4048 wrote to memory of 4052 4048 tmp.exe 95 PID 4048 wrote to memory of 4052 4048 tmp.exe 95 PID 4052 wrote to memory of 3092 4052 installer.exe 119 PID 4052 wrote to memory of 3092 4052 installer.exe 119 PID 4052 wrote to memory of 3092 4052 installer.exe 119 PID 3812 wrote to memory of 1392 3812 msiexec.exe 99 PID 3812 wrote to memory of 1392 3812 msiexec.exe 99 PID 3812 wrote to memory of 1392 3812 msiexec.exe 99 PID 3812 wrote to memory of 4604 3812 msiexec.exe 101 PID 3812 wrote to memory of 4604 3812 msiexec.exe 101 PID 3812 wrote to memory of 4604 3812 msiexec.exe 101 PID 3812 wrote to memory of 396 3812 msiexec.exe 102 PID 3812 wrote to memory of 396 3812 msiexec.exe 102 PID 3812 wrote to memory of 396 3812 msiexec.exe 102 PID 3812 wrote to memory of 5020 3812 msiexec.exe 110 PID 3812 wrote to memory of 5020 3812 msiexec.exe 110 PID 3812 wrote to memory of 5020 3812 msiexec.exe 110 PID 4052 wrote to memory of 1140 4052 installer.exe 107 PID 4052 wrote to memory of 1140 4052 installer.exe 107 PID 4052 wrote to memory of 1140 4052 installer.exe 107 PID 1244 wrote to memory of 896 1244 rutserv.exe 103 PID 1244 wrote to memory of 896 1244 rutserv.exe 103 PID 1244 wrote to memory of 896 1244 rutserv.exe 103 PID 1244 wrote to memory of 808 1244 rutserv.exe 104 PID 1244 wrote to memory of 808 1244 rutserv.exe 104 PID 1244 wrote to memory of 808 1244 rutserv.exe 104 PID 896 wrote to memory of 2088 896 rfusclient.exe 114 PID 896 wrote to memory of 2088 896 rfusclient.exe 114 PID 896 wrote to memory of 2088 896 rfusclient.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn3⤵PID:3092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:1140
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EB8B64457E6E0EEA6BFC303B82DD40132⤵
- Loads dropped DLL
PID:1392
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:396
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:2088
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray1⤵
- Executes dropped EXE
PID:808
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD52587a3a41271e8752d08de45c8091774
SHA1c770336ecfe7a3560d011625fde229cd29f38671
SHA2568b38531929657d5dfac16cba4ac78a66e72ac25853dcfe0b9236755b5b317791
SHA512611fa782803e301865166697ed9f0b1a9bfbcbd03049d88dc2e6f0e851c20cdd28eef3b0d6946fb9ea8c9c6e51ccaa1a60cd26f3b7a39abb43941b8664b20324
-
Filesize
1.0MB
MD5fe0c7ec43f259a81dab7ed581e312c3c
SHA19f6f7651141720d15df45880a9bf3b6e9d11dd35
SHA256178713fbe2493974aa1ae4063a92b335933cc98b96dc64141ab32e0564a0ceab
SHA5122a539f9eaa64b1abdb0829de5f3e31cc30d318e36db835321fcab13923dd11dc20248919e376fa0186acf33a3cd8a76ac08d0daba01f99d57a887dce3951bc7e
-
Filesize
2.2MB
MD5652a15546d4e5416bb3715ae8a00aada
SHA1d2195e3ddf9da7b33e0bf69efd13f6dc8c0da6e8
SHA2566802647456a35eac1c3553a64969a143e5d726ba340b7817676420cd62f33275
SHA512e8f04d53f765a66a6d90c04f71b3666491abaa989e05fc4c42c93ad12c7fc770c181844a19c0da7020073321dcfcf71467190eb1f3bd7b6b5b696a44501feb3c
-
Filesize
64KB
MD5e3a57b522e99419b18552f1192597ffc
SHA1b7993c64de773ca3667785e0185416f88c7f4e29
SHA256d5ed90361b1c72f1d592cde3a6722864c7c6ad43d39e204b842738d0494ae1b9
SHA51206d06786502298505ee8a5653a77e1dcf1f24f28ba5f9fcf9aa22009f840bdca1c6d5e8d125834ea9085abc74ed9729f7eb2b97425967e534b5a594afa814125
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
92KB
MD5b32fdbab0310b5f9df4b5684f1869d5c
SHA1291dc93b26430eb9560eb5be8d6d149e64171e17
SHA256d6a0b0bd6846528ca3f3d505727b1eef8cd69062237b8b34378db8e1c7ece1e0
SHA512e804cea0de422ca6268842eeba87cc22a6b26feafe89ae34bc8bc1f5f82f69883ed99ecf435690d5a68a41281491b58f39c226a6df0cbba7f9634d462cdc3049
-
C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe
MD5d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e