Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
General
-
Target
47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe
-
Size
8.3MB
-
MD5
47b91db13b09037c9190182824c54ff4
-
SHA1
6b19eec521429b0eb33d821917476cdb90e5e715
-
SHA256
96a2d431456f56877f20870ea75c9d5140e5743e73fcd402bf5a3a7d6e402b0b
-
SHA512
11bb54f3fda86ada772ec53f6a032638e95f378d4626d6afc95f94c148f056eff397ec203f4ee2ec1981917948b62bfdbca6725b8ac06282f85a29ccc2c484d7
-
SSDEEP
196608:PbHYOi1iRRteqsd3lMXbUJMuK5Scxoi6Z2Ba+z+IAp2FG0c+imht/:PLc1URtOqkMul689A+30cU/
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid Process 2016 installer.exe 2284 rutserv.exe 2236 rutserv.exe 2012 rutserv.exe 2116 rutserv.exe 408 rfusclient.exe 468 rfusclient.exe 2240 rfusclient.exe -
Loads dropped DLL 4 IoCs
Processes:
47b91db13b09037c9190182824c54ff4_JaffaCakes118.exeMsiExec.exerutserv.exepid Process 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 2812 MsiExec.exe 2116 rutserv.exe 2116 rutserv.exe -
Blocklisted process makes network request 4 IoCs
Processes:
msiexec.exeflow pid Process 3 2764 msiexec.exe 5 2764 msiexec.exe 7 2764 msiexec.exe 9 2764 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Program Files directory 53 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe -
Drops file in Windows directory 18 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\f760d0b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI137C.tmp msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\f760d0e.ipi msiexec.exe File created C:\Windows\Installer\f760d10.msi msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\f760d0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI11D6.tmp msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\f760d0e.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 24 IoCs
Processes:
msiexec.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3.4ru_mod.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
installer.exemsiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid Process 2016 installer.exe 2016 installer.exe 2016 installer.exe 2016 installer.exe 2016 installer.exe 2016 installer.exe 2764 msiexec.exe 2764 msiexec.exe 2284 rutserv.exe 2284 rutserv.exe 2284 rutserv.exe 2284 rutserv.exe 2236 rutserv.exe 2236 rutserv.exe 2012 rutserv.exe 2012 rutserv.exe 2116 rutserv.exe 2116 rutserv.exe 2116 rutserv.exe 2116 rutserv.exe 408 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid Process 2240 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2676 msiexec.exe Token: SeIncreaseQuotaPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeSecurityPrivilege 2764 msiexec.exe Token: SeCreateTokenPrivilege 2676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2676 msiexec.exe Token: SeLockMemoryPrivilege 2676 msiexec.exe Token: SeIncreaseQuotaPrivilege 2676 msiexec.exe Token: SeMachineAccountPrivilege 2676 msiexec.exe Token: SeTcbPrivilege 2676 msiexec.exe Token: SeSecurityPrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeLoadDriverPrivilege 2676 msiexec.exe Token: SeSystemProfilePrivilege 2676 msiexec.exe Token: SeSystemtimePrivilege 2676 msiexec.exe Token: SeProfSingleProcessPrivilege 2676 msiexec.exe Token: SeIncBasePriorityPrivilege 2676 msiexec.exe Token: SeCreatePagefilePrivilege 2676 msiexec.exe Token: SeCreatePermanentPrivilege 2676 msiexec.exe Token: SeBackupPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeShutdownPrivilege 2676 msiexec.exe Token: SeDebugPrivilege 2676 msiexec.exe Token: SeAuditPrivilege 2676 msiexec.exe Token: SeSystemEnvironmentPrivilege 2676 msiexec.exe Token: SeChangeNotifyPrivilege 2676 msiexec.exe Token: SeRemoteShutdownPrivilege 2676 msiexec.exe Token: SeUndockPrivilege 2676 msiexec.exe Token: SeSyncAgentPrivilege 2676 msiexec.exe Token: SeEnableDelegationPrivilege 2676 msiexec.exe Token: SeManageVolumePrivilege 2676 msiexec.exe Token: SeImpersonatePrivilege 2676 msiexec.exe Token: SeCreateGlobalPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
installer.exerutserv.exerutserv.exerutserv.exerutserv.exepid Process 2016 installer.exe 2284 rutserv.exe 2236 rutserv.exe 2012 rutserv.exe 2116 rutserv.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
47b91db13b09037c9190182824c54ff4_JaffaCakes118.exeinstaller.exemsiexec.exerutserv.exerfusclient.exedescription pid Process procid_target PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2028 wrote to memory of 2016 2028 47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe 28 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2016 wrote to memory of 2676 2016 installer.exe 29 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2812 2764 msiexec.exe 31 PID 2764 wrote to memory of 2284 2764 msiexec.exe 32 PID 2764 wrote to memory of 2284 2764 msiexec.exe 32 PID 2764 wrote to memory of 2284 2764 msiexec.exe 32 PID 2764 wrote to memory of 2284 2764 msiexec.exe 32 PID 2764 wrote to memory of 2236 2764 msiexec.exe 33 PID 2764 wrote to memory of 2236 2764 msiexec.exe 33 PID 2764 wrote to memory of 2236 2764 msiexec.exe 33 PID 2764 wrote to memory of 2236 2764 msiexec.exe 33 PID 2764 wrote to memory of 2012 2764 msiexec.exe 34 PID 2764 wrote to memory of 2012 2764 msiexec.exe 34 PID 2764 wrote to memory of 2012 2764 msiexec.exe 34 PID 2764 wrote to memory of 2012 2764 msiexec.exe 34 PID 2016 wrote to memory of 1152 2016 installer.exe 36 PID 2016 wrote to memory of 1152 2016 installer.exe 36 PID 2016 wrote to memory of 1152 2016 installer.exe 36 PID 2016 wrote to memory of 1152 2016 installer.exe 36 PID 2116 wrote to memory of 408 2116 rutserv.exe 39 PID 2116 wrote to memory of 408 2116 rutserv.exe 39 PID 2116 wrote to memory of 408 2116 rutserv.exe 39 PID 2116 wrote to memory of 408 2116 rutserv.exe 39 PID 2116 wrote to memory of 468 2116 rutserv.exe 38 PID 2116 wrote to memory of 468 2116 rutserv.exe 38 PID 2116 wrote to memory of 468 2116 rutserv.exe 38 PID 2116 wrote to memory of 468 2116 rutserv.exe 38 PID 408 wrote to memory of 2240 408 rfusclient.exe 40 PID 408 wrote to memory of 2240 408 rfusclient.exe 40 PID 408 wrote to memory of 2240 408 rfusclient.exe 40 PID 408 wrote to memory of 2240 408 rfusclient.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47b91db13b09037c9190182824c54ff4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:1152
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 57D09F54D9B6178515001849B1C15F032⤵
- Loads dropped DLL
PID:2812
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:468
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:2240
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD51ae1d3f3ac3bc15702abd2ef917f3a49
SHA161570e1997f0a847cc5969a84ea5799f75a5bdf3
SHA2569638ef9c80c650b10b1eff3cf071af8c21addd4374c8e63ee9fe295762ef7896
SHA512cfa2ccc6efae891c1466ce1476cdb923193f236f2f54871cd754abac9aa39ea7e00fabff131b2e2d9df845343575e9a62583772aeca83f2c24bd2b28bccdbf41
-
Filesize
43KB
MD5bc25377ade68750b834c81fa71c233b8
SHA184dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA2569a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5
-
Filesize
144KB
MD52ddfa39f5c2fd3f00681ef2970617e4b
SHA18152aa18afbacf398b92168995ec8696d3fe3659
SHA256f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20
-
Filesize
975KB
MD53d0b27b3f8aa22575aa0faf0b2d67216
SHA139fc787538849692ed7352418616f467b7a86a1d
SHA256d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44
SHA51219f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8
-
Filesize
48KB
MD5e44e34bc285b709f08f967325d9c8be1
SHA1e73f05c6a980ec9d006930c5343955f89579b409
SHA2561d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
-
Filesize
5.1MB
MD576ebe5fd077a62161d0ab560208b9f94
SHA1614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde
-
Filesize
378KB
MD5292a1748850d1fdc91d4ec23b02d6902
SHA18f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704
-
Filesize
1.6MB
MD54570f7a40357016c97afe0dd4faf749b
SHA1ebc8a1660f1103c655559caab3a70ec23ca187f1
SHA256a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8
SHA5126b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b
-
Filesize
258KB
MD5038bf9f3a58560ad1130eeb85cdc1a87
SHA13571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA5128ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385
-
Filesize
363KB
MD5eeb2c52abbc7eb1c029b7fec45a7f22e
SHA18bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA5120b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85
-
Filesize
858KB
MD5e38372f576d927f525ef8e1a34b54664
SHA126af9d1db0a3f91d7fe13147e55f06c302d59389
SHA2564046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b
SHA51278b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7
-
Filesize
7.4MB
MD5a74f9058e24d450f209f895592252c20
SHA1062f717ad76ed66013a3a71dae978690027e5ed3
SHA25617846007267f4af2776577e216ca1899644f015eb7f399c52005e519e7e7fa21
SHA512dca3266f920b0d95110647e173ff66665372c0d7fd5da99efb9e27079e84a49a8f4ee263879dd42c14c7629137a4f94148a8dceae88f83c91fdfd95e5b49824e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
413B
MD5b84b9bab28ef23fa881b625cb9524106
SHA12c1c68374a9c71d1d48d1049049705c66eae7b93
SHA25627414b5d8d18599be1ee59eb926afb323a2e49d648e79636acaceba8b511730e
SHA512bcdbb91811129ba0f86e59aca50fc77333218d36dd11a025f235fcbae5915984b29a3e3377ede6cb6e0e18982551299db319285f59b1fd5fc4794ef591f24a2f
-
C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe
Filesize96KB
MD59e2c097647125ee25068784acb01d7d3
SHA11a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
SHA256b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
SHA512e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
-
Filesize
6.0MB
MD5c9704931d887685d96ce92d637d84045
SHA10875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA2560448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA5123b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7