Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/03/2024, 07:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
General
- Target tmp.exe
- Size 8.3MB
- Sample240301-jcf1aaed53
- SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
- MD5 73f351beae5c881fafe36f42cde9a47c
- SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
- SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66
- SSDEEP 196608:PdQ5Lq4eAGPJgBDpKLtW0tzHlYd3cvF8m9k/RRZpAp2FG0c+imhtO:P2VqyC8mQ0vxN79kpR40cUO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation installer.exe - Executes dropped EXE 8 IoCs
pid Process 2172 installer.exe 1360 rutserv.exe 224 rutserv.exe 3428 rutserv.exe 2776 rutserv.exe 1172 rfusclient.exe 400 rfusclient.exe 2932 rfusclient.exe - Loads dropped DLL 1 IoCs
pid Process 4652 MsiExec.exe - Blocklisted process makes network request 3 IoCs
flow pid Process 28 3208 msiexec.exe 30 3208 msiexec.exe 32 3208 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\Installer\e57cf89.msi msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\MSID59F.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{D9E14363-FD66-419D-9DC9-C62471755C9F} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\e57cf85.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID86F.tmp msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\e57cf85.msi msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 2172 installer.exe 3208 msiexec.exe 3208 msiexec.exe 1360 rutserv.exe 1360 rutserv.exe 1360 rutserv.exe 1360 rutserv.exe 1360 rutserv.exe 1360 rutserv.exe 224 rutserv.exe 224 rutserv.exe 3428 rutserv.exe 3428 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 1172 rfusclient.exe 1172 rfusclient.exe - Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 2932 rfusclient.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4216 msiexec.exe Token: SeIncreaseQuotaPrivilege 4216 msiexec.exe Token: SeSecurityPrivilege 3208 msiexec.exe Token: SeCreateTokenPrivilege 4216 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4216 msiexec.exe Token: SeLockMemoryPrivilege 4216 msiexec.exe Token: SeIncreaseQuotaPrivilege 4216 msiexec.exe Token: SeMachineAccountPrivilege 4216 msiexec.exe Token: SeTcbPrivilege 4216 msiexec.exe Token: SeSecurityPrivilege 4216 msiexec.exe Token: SeTakeOwnershipPrivilege 4216 msiexec.exe Token: SeLoadDriverPrivilege 4216 msiexec.exe Token: SeSystemProfilePrivilege 4216 msiexec.exe Token: SeSystemtimePrivilege 4216 msiexec.exe Token: SeProfSingleProcessPrivilege 4216 msiexec.exe Token: SeIncBasePriorityPrivilege 4216 msiexec.exe Token: SeCreatePagefilePrivilege 4216 msiexec.exe Token: SeCreatePermanentPrivilege 4216 msiexec.exe Token: SeBackupPrivilege 4216 msiexec.exe Token: SeRestorePrivilege 4216 msiexec.exe Token: SeShutdownPrivilege 4216 msiexec.exe Token: SeDebugPrivilege 4216 msiexec.exe Token: SeAuditPrivilege 4216 msiexec.exe Token: SeSystemEnvironmentPrivilege 4216 msiexec.exe Token: SeChangeNotifyPrivilege 4216 msiexec.exe Token: SeRemoteShutdownPrivilege 4216 msiexec.exe Token: SeUndockPrivilege 4216 msiexec.exe Token: SeSyncAgentPrivilege 4216 msiexec.exe Token: SeEnableDelegationPrivilege 4216 msiexec.exe Token: SeManageVolumePrivilege 4216 msiexec.exe Token: SeImpersonatePrivilege 4216 msiexec.exe Token: SeCreateGlobalPrivilege 4216 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe Token: SeRestorePrivilege 3208 msiexec.exe Token: SeTakeOwnershipPrivilege 3208 msiexec.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2172 installer.exe 1360 rutserv.exe 224 rutserv.exe 3428 rutserv.exe 2776 rutserv.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2172 1244 tmp.exe 96 PID 1244 wrote to memory of 2172 1244 tmp.exe 96 PID 1244 wrote to memory of 2172 1244 tmp.exe 96 PID 2172 wrote to memory of 4216 2172 installer.exe 99 PID 2172 wrote to memory of 4216 2172 installer.exe 99 PID 2172 wrote to memory of 4216 2172 installer.exe 99 PID 3208 wrote to memory of 4652 3208 msiexec.exe 102 PID 3208 wrote to memory of 4652 3208 msiexec.exe 102 PID 3208 wrote to memory of 4652 3208 msiexec.exe 102 PID 3208 wrote to memory of 1360 3208 msiexec.exe 103 PID 3208 wrote to memory of 1360 3208 msiexec.exe 103 PID 3208 wrote to memory of 1360 3208 msiexec.exe 103 PID 3208 wrote to memory of 224 3208 msiexec.exe 104 PID 3208 wrote to memory of 224 3208 msiexec.exe 104 PID 3208 wrote to memory of 224 3208 msiexec.exe 104 PID 3208 wrote to memory of 3428 3208 msiexec.exe 105 PID 3208 wrote to memory of 3428 3208 msiexec.exe 105 PID 3208 wrote to memory of 3428 3208 msiexec.exe 105 PID 2776 wrote to memory of 400 2776 rutserv.exe 108 PID 2776 wrote to memory of 400 2776 rutserv.exe 108 PID 2776 wrote to memory of 400 2776 rutserv.exe 108 PID 2776 wrote to memory of 1172 2776 rutserv.exe 107 PID 2776 wrote to memory of 1172 2776 rutserv.exe 107 PID 2776 wrote to memory of 1172 2776 rutserv.exe 107 PID 2172 wrote to memory of 2404 2172 installer.exe 109 PID 2172 wrote to memory of 2404 2172 installer.exe 109 PID 2172 wrote to memory of 2404 2172 installer.exe 109 PID 1172 wrote to memory of 2932 1172 rfusclient.exe 111 PID 1172 wrote to memory of 2932 1172 rfusclient.exe 111 PID 1172 wrote to memory of 2932 1172 rfusclient.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:2404
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 205634C1F12310B8E876948EB616725E2⤵
- Loads dropped DLL
PID:4652
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:224
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3428
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:2932
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:81⤵PID:4716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57cf88.rbs
- Size 19KB
- SHA256 3b3ebd8b17bb2cf81a57e944f28b1f6a4e35fec774ac55ef4b2c7cdfc094e563
- MD5 e457c396447aa319e95d1f2a13b15c2f
- SHA1 e82f4b93e061a9f3889fa9559d076d5c046cfaef
- SHA512 5c792c43cab815ed6175413345af6eaec17ae32dd073d359bae1115f9e9f1054dd60374e2fee71b3f5e6509b1efaf871ab89013b3cce72c94004ccc9f5ae8382
- SSDEEP 192:7VxDtQz3oSctGmoboOcjvPDkp59akA6sCo9sMPZyVxuAhBgaJ4BgabnihbpNe4ut:7VxDtyAGmoboOcjvrnh+BglBg5by/T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\English.lg
- Size 43KB
- SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
- MD5 bc25377ade68750b834c81fa71c233b8
- SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
- SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5
- SSDEEP 384:3KrjWualU4EN/1Ddsn9QBWSJEsLwBlnywsOO+sEs1T8D:1u24sSiln0k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll
- Size 144KB
- SHA256 f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
- MD5 2ddfa39f5c2fd3f00681ef2970617e4b
- SHA1 8152aa18afbacf398b92168995ec8696d3fe3659
- SHA512 f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20
- SSDEEP 1536:pN+2zUKhpXMEvo5JgC61vU+zc2XtAs0NaYuvHlIO6rvkWgYzMDi6N92PPGT/uTPo:X+2YKnMA3ssMJkvRYGT/aFm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll
- Size 512KB
- SHA256 8824bb730d0e264ee256a463430440f4996864c6f275f413470a4feadd9750b3
- MD5 9605601926669dbe4b75b14e5adc6295
- SHA1 768578eb27c9e2ff15d0a8f5eef741963abd88fc
- SHA512 527464b47e22d596aa263257969fbcf7844791f0f1801aa3e400be6d43ac66afbca4b9893d42fc4b4b09561d303fd56d5456006d710018f0f7fd57d87a5bb5c1
- SSDEEP 6144:q85MrKCYwf3bXqCtzWR+pe9+ADb5k0XEC0+MGV6z:N6FYwTjlq9DWl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg
- Size 48KB
- SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
- MD5 e44e34bc285b709f08f967325d9c8be1
- SHA1 e73f05c6a980ec9d006930c5343955f89579b409
- SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
- SSDEEP 384:4KS6FpsTkMiUOaTzVnYwu6GXFGejSkdBz+lcvN7sdW:XsTkd2m9dB7P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
- Size 256KB
- SHA256 ca0d1fc869490fecbfcbd099304c2ccd9228baf01f44f9adc9ac366b34d4a1e5
- MD5 29b2e81229c2245ef4d4a6e413d33745
- SHA1 017cb7f2f4704cc9e0f31e1e619b3ebf70e1eba7
- SHA512 4d54f0e813f6c2815eb80ede03785c6ab7c5879a244d54b54d5f88eb2332ce4d59fc73ac32f9a23b64f3606cb82318b8625a2baa3b98778c76bb6c03cded4061
- SSDEEP 3072:ySrOrot6tebHhOSe3jQbAxqycHWmObU30q1rWkGvWdFv7SFEV0K3kRrbBIasu:f8ot6tgBOzzQEMyyIoGv87Mm0K3kRn6o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
- Size 31KB
- SHA256 ee28f3928a2e2c385d4851a391a51d6db0e790fc96d2125b4e20278f340c7988
- MD5 0d0e164d5ffb273d6263f3e73c447599
- SHA1 55359d4b5fee3260cc27409012652021dab45502
- SHA512 b2365920fc4f001830ed6095f9363f5460bdccf09e5698fbf2d345b26a1e1e0ca9c10e5f45259b04eb5ca00e6f86ed10b86b544ddfa44d823c286ff0a57b95cf
- SSDEEP 384:JQ3pdwsx+sKm7SSU5eUggfJieORPhtBhed6eWCt6D5eiGkYi7gQMe0pIOfg:ydYRR4gfrOrHhit6D5eiaiEVfIOI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
- Size 5.1MB
- SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
- MD5 76ebe5fd077a62161d0ab560208b9f94
- SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
- SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde
- SSDEEP 49152:WjR6DGs/hYPBzEoZ6SNbpJjwsmozStrH45/oLNNmsrq6dSJu0ThTCWcFeIMwck9t:WjA7up5Us55iNYsrdkMFqr+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
- Size 2.2MB
- SHA256 c1631f5f8ff899efd11830ef9b75f99eb4e3904b8d57abc6f3ecb8e666530900
- MD5 9f0222125fece61f176a9908b0e679a7
- SHA1 1ffb2c781316d51bbbfb0cc5786b1f066d8cfe7c
- SHA512 78aa40c83b82cb4899c4b2bedb9680f1e51159b8ed1ce257f0467e798f1592bb06c280cc2210356f834e8364482875cc954512825991f445631a8b3939f226bd
- SSDEEP 24576:9LYVkAnjueXdLYy1MDyr9P7gmlUE8DJ8vxDTlWIBgIK+DBqSKlQpDmVcIR0fW3gS:9+nzXh9TjPa4D8S0Qhqc43gS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll
- Size 378KB
- SHA256 acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
- MD5 292a1748850d1fdc91d4ec23b02d6902
- SHA1 8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
- SHA512 cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704
- SSDEEP 6144:mIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcb:mI8tiDOzyH9H8Tu6h04fZMZoMPuvfL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll
- Size 411KB
- SHA256 2f12d3a2b1cc0522edb492f5270f9f046912cba70f67ce235afc11389216fa67
- MD5 e11e9d13a59f1a027ce07a1f2bdd7b46
- SHA1 45c5f4e3977396274ef4d126ec54dddf7380e704
- SHA512 32fa13b5209123171750804fecbfcacade88a0c60fb6d44c2ba94d6da61b439eff4e3aa5271a24ece98d63da3d53392211e8b281a7cd55dae726097c5957552f
- SSDEEP 12288:mI7SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwf:9SSSSSSSSSSSSSSSSSSSSSSSSSSSSSS9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll
- Size 258KB
- SHA256 d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
- MD5 038bf9f3a58560ad1130eeb85cdc1a87
- SHA1 3571eb7293a2a3a5bf6eb21e1569cd151d995d1a
- SHA512 8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385
- SSDEEP 3072:aW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTW:aWSfr7sXSmPDbKPJ6/AsNk+w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll
- Size 320KB
- SHA256 318b0ef25836b0ad1b2df61505ef6080e563f713cc8c2e9429b07981a168dd31
- MD5 463ef4c54f34546d28632fe542643c7d
- SHA1 1b9123a06746ada4df47aa2775bb05c55dae7231
- SHA512 e6ace5bfa93d3d0c71bbd11421fd512b212be617edd87f95d58356cf104ba8ec35e2bdc7ff6e2b1a5344d2125226d1c946f902e7a4156df5435580784316d954
- SSDEEP 6144:laoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAd:ZoPH0GgEp0gVd1ValsQXsu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll
- Size 256KB
- SHA256 10d06a73a6bdb0ce1b95b2890d0731518f3c19f9c79c1cfb70b913fcff73053b
- MD5 08c96841f5084e787b15566f30f0f82f
- SHA1 467b59227c1200e35ad35e43e4cc94b36b55286b
- SHA512 f5047052e1b15cf63385ff6c34d5abf0b0472dc0d104f56357e837d294a329d73eca1e4ecab59c6e0f9b87beec9fca1b620b9efe508e9a4e30dc41b3bcd56c08
- SSDEEP 3072:C/WsHzIIFkOaN/2b6tTlEUeT9utYcyBlEyABsUpt3y2Qh9NtrL5h+r0Al22QqRNO:CusH7XaNubTUYKYcolEySsrWNNDnaJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
- Size 6.0MB
- SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
- MD5 c9704931d887685d96ce92d637d84045
- SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
- SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260
- SSDEEP 49152:9+nzXh9TjPa4D8S0Qhqc43geRZsUHqDUNBF4DRJi8pMmYZufEPp8csPdTY2TgTNt:9+bTiFIqw96IDymYZufEPptsm9LuiVD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi
- Size 1.5MB
- SHA256 fa90914da3860609dca836fd3ad9dcef66302916be4605b202315d46b5e89099
- MD5 158da639c0c326fddb817067f978bc7c
- SHA1 2ef40951a31e01bbf66c6c343cea9d2268473cb4
- SHA512 2ffe91aada42d319923d99b4900016464c3665cab462c26fb5860083b0949f5748692a310d2b75ccc5c8cc9f06ed0577f0e6fffbfb431f336d5340216b2187cf
- SSDEEP 24576:JvPthnYyzQ+DUqGxcWpH7Ksjkqz+z+kQS:JvPtlYyM5cqNjkq2+kz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\killself.bat
- Size 411B
- SHA256 b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352
- MD5 c2ac85b000427a4a00f19da237aaaf86
- SHA1 459ecb5e64576348e6c654724e87825772c06ea8
- SHA512 e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSID59F.tmp
- Size 125KB
- SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
- MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
- SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
- SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
- SSDEEP 1536:o2/dai5RmZDDeTITe2DClwhJwyxncO6Nyc/ldjTbl1gO:bai5RIWTybwyxnchNyc/ldj/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57cf89.msi
- Size 7.4MB
- SHA256 8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4
- MD5 73e578a44265558d3ace212869d43cbb
- SHA1 d2c15578def8996ed0ae4a44754055b774b095a7
- SHA512 fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4
- SSDEEP 98304:lYyOcWYqMk1o1X1U5Izu1stWqQDI5bfW4At+dlqRokRAsiC8hDonF3WueTB+He9C:CMrqI0qdewdlq+kqOFGueA+9caV6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe
- Size 96KB
- SHA256 b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
- MD5 9e2c097647125ee25068784acb01d7d3
- SHA1 1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
- SHA512 e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
- SSDEEP 1536:cdU81cOXdrITHGKhoa+5g0SzIV8Q5B5yx5lJlieKVL:8jcnmZ5g0SzkB5Q5V6V
- MD5 SHA1 SHA512 SSDEEP