rms | 2db4c8f3de370ce986d40094283e66f2d7e8b73c4ab3ab797a3443b54bc48f63

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe
Size

2.7MB
MD5

bcd60a52e09a677d14a87f8cf55fce9b
SHA1

69f723a2acea3e9ef0dc72c65d2fd43206009d3c
SHA256

2db4c8f3de370ce986d40094283e66f2d7e8b73c4ab3ab797a3443b54bc48f63
SHA512

0b30ea4050cbf1219bfbf965d61236fc181186917830b7d41748b10a367e33aaf3403569de61c517c7b88cd3ac10394f443243821ab2a55e41f1f0f3e62af2be
SSDEEP

49152:jWTx21QlbRc+URFrOltwUA2wKEAdGS/9bB8Jks30RftSkugk6vQ:qt210bR2ruwUTEUL/4axtSkuWvQ

Score

10^/10

rms evasion persistence privilege_escalation rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
464	netsh.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
752	attrib.exe
1980	attrib.exe
1220	attrib.exe
2148	attrib.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000018bf9-34.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
2912	run.exe
2720	data.exe
1620	winlogs.exe

Loads dropped DLL 5 IoCs

pid	Process
1892	WScript.exe
1892	WScript.exe
2476	cmd.exe
3004	cmd.exe
3004	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000018bf9-34.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\winlogs.exe"	reg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\h4nb2ewfu823r9jdsfijsfj43-f_9346239.txt	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2788	timeout.exe
1828	timeout.exe
748	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1236	taskkill.exe
2828	taskkill.exe
2844	taskkill.exe
2880	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2140	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	winlogs.exe
1620	winlogs.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeTakeOwnershipPrivilege	1620	winlogs.exe
Token: SeTcbPrivilege	1620	winlogs.exe
Token: SeTcbPrivilege	1620	winlogs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	winlogs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 2960 wrote to memory of 1892	2960	bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe	28
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 1892 wrote to memory of 2912	1892	WScript.exe	29
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2912 wrote to memory of 2476	2912	run.exe	31
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2476 wrote to memory of 2720	2476	cmd.exe	32
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2720 wrote to memory of 2416	2720	data.exe	33
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2480	2416	WScript.exe	34
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2416 wrote to memory of 2500	2416	WScript.exe	35
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2480 wrote to memory of 3004	2480	wscript.exe	37
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 2416 wrote to memory of 2972	2416	WScript.exe	36
PID 3004 wrote to memory of 464	3004	cmd.exe	39

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
752	attrib.exe
1980	attrib.exe
1220	attrib.exe
2148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bcd60a52e09a677d14a87f8cf55fce9b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows\run.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Windows\run.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows\run.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c build\data.exe -p7L34MF845JMHY0 -d C:\Log
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
        
        build\data.exe -p7L34MF845JMHY0 -d C:\Log
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        7⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Log\Windows\hiscomponent\install.bat" "
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:464
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im systemc.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im drivemanag.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        9⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f
        9⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f
        9⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Users\Admin\AppData\Local\Temp\System"
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Log"
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1980
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "Windows\hiscomponent\regedit.reg"
        9⤵
        Runs .reg file with regedit
        
        PID:2140
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        9⤵
        Delays execution with timeout.exe
        
        PID:1828
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        9⤵
        Delays execution with timeout.exe
        
        PID:748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Users\Admin\AppData\Local\Temp\System\*.*"
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Users\Admin\AppData\Local\Temp\System\winlogs.exe"
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\System\winlogs.exe
        
        winlogs.exe
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Services" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\System\winlogs.exe" /f
        9⤵
        Adds Run key to start application
        
        PID:2644
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        9⤵
        Delays execution with timeout.exe
        
        PID:2788
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        7⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
        7⤵
        
        PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Log\Windows\hiscomponent\install.bat

Filesize
1KB

MD5
63ece2bf19d44f7356c4a6236cdd3a3c

SHA1
59a9582c1401caec402efcd6d38227fc63dfcb79

SHA256
a28cdbf4e7f6186fe15e11ead25fb8102c580fccfb4f395147bcb24ad0252148

SHA512
d2f86c495071c2ca41462997bc8aaedce2970b574bfb4361ae413d138b823b26ae4fdc3660e57cd3f5f72c7f3e1512fea8e72aefc93eb38da5f78b55e27d5401

Download Submit
C:\Log\Windows\hiscomponent\regedit.reg

Filesize
12KB

MD5
98b13bb0c8bb7d3c5c89616fa0c18b0c

SHA1
2e665aa4290286c16b6e23c717d9724cdfff9c42

SHA256
895ef017706b96a2992b502258958d5741a80869c45b893aaff2e9c12b124e33

SHA512
9bdb8156ebb3258c054d82e82ed0ab7e4e58faa68a0d1c3e5f6412704bc8700609114f1e1ed88b85020b4f530b1bfba156c32ee619ffce0a3ab3bb9b845b764d

Download Submit
C:\Log\Windows\hiscomponent\vp8encoder.dll

Filesize
593KB

MD5
6298c0af3d1d563834a218a9cc9f54bd

SHA1
0185cd591e454ed072e5a5077b25c612f6849dc9

SHA256
81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

SHA512
389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

Download Submit
C:\Log\install.vbs

Filesize
935B

MD5
cf4d53fda5ec29078fdbd41ab3c2223b

SHA1
18fd3fec94d0021b397b1fbc5bf1f5a654bf8d0c

SHA256
0695f01429e7e5406a6a4e34a3fdd1a680ff710dc1c0629b49c072998153d59e

SHA512
b7fef3d152839c91669e5df4035faee6f48a7e1910c6b0577b94d666239a567fcde76121a4e63639fa79ea5bb1d2ddc315e2df970da5c72d46d085f9b3697eec

Download Submit
C:\Log\winlogs.exe

Filesize
6.0MB

MD5
77c49c618c6ffcb69329a245a5e5d5bb

SHA1
786f92ecc53a7d329fafdb4b41c00b0888bc9db9

SHA256
1bf4e09d416c6c9619f5f66fff7c5d642e553508f99d9cbc58b3950291da6228

SHA512
13461eaa29f5d8cb49fba8e381bc637f7de2b63b88bd004b9562b64467453abf9cbcdb195ca72e28b4deacd73a63e36657ce9055e026bd184cea224e399bce10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
2.4MB

MD5
45fd55bb5849a38f7a05017da22d5366

SHA1
3b500aef17a8689ff273ade1df375265e8d27dd6

SHA256
8023cf0b82868118518e39f7a3675e93f8cc5b3a1fea1684ff77d0a0caa573e8

SHA512
7bec4f99383162ae83f6257c37836332352e8a88b3c00cc46bf08b1a5d5516b6e9fe7b0c6d19e5caafed4b0f4ef987fc2cabeedc4b39821afb8fb96e603c6c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\run.exe

Filesize
55KB

MD5
f82931780fbeeac7aaa354720bf30daf

SHA1
74d4ef5e5a2e9803f115b9e0b06e9d11c322ae8b

SHA256
ef450765c9e7c06f178e84641b08d8282633305cb3798d692b9b274bdd334e69

SHA512
7ed3d23720112fbff8a7636d00dda8b1f81d248a7025a7111a016a14d39574f159be56ed5ce887baeac02c9c2b57db2ddde69556d7a4728be91aa15413ff8a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\run.vbs

Filesize
113B

MD5
7c274b85448ea218e5c6d5521876f698

SHA1
bdd771453446e1e8654985f5c4b7ebb0bb9ada4d

SHA256
427b7d229ae6a8717edb0e5cc156c2025d0d737400d6a22d5de9d4504b7b3185

SHA512
3c0a482e3f5b628cccae9730fb7fbf2f9e8c6fb7d8c52d39beffe8b3a3de184d2df6d5fa412801eca6cf80a7ee8109394e4918c467af88dac767462f01051df6

Download Submit
memory/1620-42-0x0000000000400000-0x0000000000A96000-memory.dmp

Filesize
6.6MB

Download
memory/1620-45-0x0000000000400000-0x0000000000A96000-memory.dmp

Filesize
6.6MB

Download
memory/1620-47-0x0000000000400000-0x0000000000A96000-memory.dmp

Filesize
6.6MB

Download
memory/1620-50-0x0000000000400000-0x0000000000A96000-memory.dmp

Filesize
6.6MB

Download