rms | b53c443e37a06cf2c031531e3558e9f1cc2639d8f20148714f1744e3ed622681

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70f515d95bea22b5764185f203b57925_JaffaCakes118.exe
Size 2.7MB
Sample240725-yeebssteqa
SHA256 b53c443e37a06cf2c031531e3558e9f1cc2639d8f20148714f1744e3ed622681
MD5 70f515d95bea22b5764185f203b57925
SHA1 5f5254764798d53bfdf2a00e235697bd222554fa
SHA512 6734f42c5791309ee166db4e0397473496295bc47b4e7cd87c00c3c9a988cbf70176b8d609295fa6bb947789e6f81b3a874e8facf294ab4d03894b17f996238d
SSDEEP 49152:QAJYJUfOJH2bzzkE/gNXov3rM+XhghAaecWviq7XzGx38uPDzWkmLm6oyq8bL7A1:7JYJIOJGzGmoPh/AJDGDLCHmI/S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms defense_evasion discovery evasion execution persistence privilege_escalation rat trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
4252	net.exe
1660	net1.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1476	netsh.exe
4772	netsh.exe
4128	netsh.exe
3392	netsh.exe
2148	netsh.exe
768	netsh.exe
5028	netsh.exe
3616	netsh.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3576	attrib.exe
3116	attrib.exe
2440	attrib.exe
2708	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe

Executes dropped EXE 7 IoCs

pid	Process
1220	rutserv.exe
3508	rutserv.exe
1944	rutserv.exe
3116	rutserv.exe
2440	rfusclient.exe
2340	rfusclient.exe
3488	rfusclient.exe

Loads dropped DLL 14 IoCs

pid	Process
1220	rutserv.exe
1220	rutserv.exe
3508	rutserv.exe
3508	rutserv.exe
1944	rutserv.exe
1944	rutserv.exe
3116	rutserv.exe
3116	rutserv.exe
2440	rfusclient.exe
2440	rfusclient.exe
2340	rfusclient.exe
2340	rfusclient.exe
3488	rfusclient.exe
3488	rfusclient.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rutserv.pdb	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\rutserv.pdb	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\exe\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4788	sc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2416	taskkill.exe
736	taskkill.exe
4600	taskkill.exe
3948	taskkill.exe
3976	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2016	reg.exe
1784	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4912	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3116	rutserv.exe
3116	rutserv.exe
3116	rutserv.exe
3116	rutserv.exe
2440	rfusclient.exe
2440	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	1220	rutserv.exe
Token: SeDebugPrivilege	1944	rutserv.exe
Token: SeTakeOwnershipPrivilege	3116	rutserv.exe
Token: SeTcbPrivilege	3116	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 208	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	87
PID 2232 wrote to memory of 208	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	87
PID 2232 wrote to memory of 208	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	87
PID 208 wrote to memory of 3236	208	WScript.exe	88
PID 208 wrote to memory of 3236	208	WScript.exe	88
PID 208 wrote to memory of 3236	208	WScript.exe	88
PID 2232 wrote to memory of 5084	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	90
PID 2232 wrote to memory of 5084	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	90
PID 2232 wrote to memory of 5084	2232	70f515d95bea22b5764185f203b57925_JaffaCakes118.exe	90
PID 3236 wrote to memory of 3844	3236	cmd.exe	92
PID 3236 wrote to memory of 3844	3236	cmd.exe	92
PID 3236 wrote to memory of 3844	3236	cmd.exe	92
PID 3236 wrote to memory of 736	3236	cmd.exe	93
PID 3236 wrote to memory of 736	3236	cmd.exe	93
PID 3236 wrote to memory of 736	3236	cmd.exe	93
PID 3236 wrote to memory of 4600	3236	cmd.exe	95
PID 3236 wrote to memory of 4600	3236	cmd.exe	95
PID 3236 wrote to memory of 4600	3236	cmd.exe	95
PID 3236 wrote to memory of 5016	3236	cmd.exe	96
PID 3236 wrote to memory of 5016	3236	cmd.exe	96
PID 3236 wrote to memory of 5016	3236	cmd.exe	96
PID 3236 wrote to memory of 2708	3236	cmd.exe	97
PID 3236 wrote to memory of 2708	3236	cmd.exe	97
PID 3236 wrote to memory of 2708	3236	cmd.exe	97
PID 3236 wrote to memory of 2440	3236	cmd.exe	98
PID 3236 wrote to memory of 2440	3236	cmd.exe	98
PID 3236 wrote to memory of 2440	3236	cmd.exe	98
PID 3236 wrote to memory of 3116	3236	cmd.exe	99
PID 3236 wrote to memory of 3116	3236	cmd.exe	99
PID 3236 wrote to memory of 3116	3236	cmd.exe	99
PID 3236 wrote to memory of 3576	3236	cmd.exe	100
PID 3236 wrote to memory of 3576	3236	cmd.exe	100
PID 3236 wrote to memory of 3576	3236	cmd.exe	100
PID 3236 wrote to memory of 3944	3236	cmd.exe	101
PID 3236 wrote to memory of 3944	3236	cmd.exe	101
PID 3236 wrote to memory of 3944	3236	cmd.exe	101
PID 3944 wrote to memory of 640	3944	net.exe	102
PID 3944 wrote to memory of 640	3944	net.exe	102
PID 3944 wrote to memory of 640	3944	net.exe	102
PID 3236 wrote to memory of 3948	3236	cmd.exe	103
PID 3236 wrote to memory of 3948	3236	cmd.exe	103
PID 3236 wrote to memory of 3948	3236	cmd.exe	103
PID 3236 wrote to memory of 3976	3236	cmd.exe	104
PID 3236 wrote to memory of 3976	3236	cmd.exe	104
PID 3236 wrote to memory of 3976	3236	cmd.exe	104
PID 3236 wrote to memory of 2416	3236	cmd.exe	105
PID 3236 wrote to memory of 2416	3236	cmd.exe	105
PID 3236 wrote to memory of 2416	3236	cmd.exe	105
PID 3236 wrote to memory of 1036	3236	cmd.exe	106
PID 3236 wrote to memory of 1036	3236	cmd.exe	106
PID 3236 wrote to memory of 1036	3236	cmd.exe	106
PID 3236 wrote to memory of 2336	3236	cmd.exe	107
PID 3236 wrote to memory of 2336	3236	cmd.exe	107
PID 3236 wrote to memory of 2336	3236	cmd.exe	107
PID 3236 wrote to memory of 2920	3236	cmd.exe	108
PID 3236 wrote to memory of 2920	3236	cmd.exe	108
PID 3236 wrote to memory of 2920	3236	cmd.exe	108
PID 3236 wrote to memory of 3324	3236	cmd.exe	109
PID 3236 wrote to memory of 3324	3236	cmd.exe	109
PID 3236 wrote to memory of 3324	3236	cmd.exe	109
PID 3236 wrote to memory of 3736	3236	cmd.exe	110
PID 3236 wrote to memory of 3736	3236	cmd.exe	110
PID 3236 wrote to memory of 3736	3236	cmd.exe	110
PID 3236 wrote to memory of 4872	3236	cmd.exe	111

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3736	attrib.exe
2708	attrib.exe
1036	attrib.exe
2336	attrib.exe
3324	attrib.exe
4872	attrib.exe
3964	attrib.exe
1116	attrib.exe
3576	attrib.exe
3116	attrib.exe
2440	attrib.exe
2920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\70f515d95bea22b5764185f203b57925_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70f515d95bea22b5764185f203b57925_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Checks computer location settings
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mes.js"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im RManServer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:736
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rutserv.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\System32\catroot3"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows\System32\de.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3576
  - - C:\Windows\SysWOW64\net.exe
      net stop rserver3
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rserver3.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im r_server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cam_server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\cam_server.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\system32\rserver30"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\SysWOW64\rserver30"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\r_server.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4872
  - - C:\Windows\SysWOW64\net.exe
      net stop Telnet
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
  - - C:\Windows\SysWOW64\sc.exe
      sc config tlntsvr start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4788
  - - C:\Windows\SysWOW64\net.exe
      net stop "Service Host Controller"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant /delete
      4⤵
      Indicator Removal: Network Share Connection Removal
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        5⤵
        Indicator Removal: Network Share Connection Removal
        System Location Discovery: System Language Discovery
        
        PID:1660
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn security /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="RealIP"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:768
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5028
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Service Host Controller"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete portopening tcp 57009
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4128
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="cam_server"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3392
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete portopening tcp 57011 all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1812
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1172
  - - C:\Windows\SysWOW64\catroot3\rutserv.exe
      "rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1220
  - - C:\Windows\SysWOW64\catroot3\rutserv.exe
      "rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s set.reg
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:4912
  - - C:\Windows\SysWOW64\catroot3\rutserv.exe
      "rutserv.exe" /start
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084

C:\Windows\SysWOW64\catroot3\rutserv.exe
C:\Windows\SysWOW64\catroot3\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- - C:\Windows\SysWOW64\catroot3\rfusclient.exe
    C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3488
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 264B
SHA256 0c4237f0cd64e96ede10567d79aa432034f2a9d036cd6114f1073777674f9576
MD5 36755128e7e611bd4f10148adebd3fdc
SHA1 e76d2df142014aea9ebacdb3ec60aa304edb7188
SHA512 39e24ea4f55c9c57769c0602780221850fcd85ef89ba37dbc6082a4787a588bd522550c5b7ed699c4d1708ab339dd5454270fe32f167cd7678ffeb02560f5fa6
MD5 SHA1 SHA512

Submit Download

HookDrv.dll

Path C:\Users\Admin\AppData\Local\Temp\HookDrv.dll
Size 144KB
SHA256 02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e
MD5 513066a38057079e232f5f99baef2b94
SHA1 a6da9e87415b8918447ec361ba98703d12b4ee76
SHA512 83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5
SSDEEP 3072:WE31FfaUrIM5iCO11Qh4s1qLm7ztS/0LFJyvgZAVDqse:WE3bTrIZHZi78/mFJH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc
MD5 d34b3da03c59f38a510eaa8ccc151ec7
SHA1 41b978588a9902f5e14b2b693973cb210ed900b2
SHA512 231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7
MD5 SHA1 SHA512

Submit Download

PushSource.ax

Path C:\Users\Admin\AppData\Local\Temp\PushSource.ax
Size 448KB
SHA256 0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7
MD5 d7eb741be9c97a6d1063102f0e4ca44d
SHA1 bf8bdca7f56ed39fb96141ae9593dec497f4e2c8
SHA512 cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e
SSDEEP 12288:SQwLjD6RoFxOsSyGiL39888888888888W88888888888:+j+RoFxOs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

RIPCServer.dll

Path C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll
Size 96KB
SHA256 24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844
MD5 329354f10504d225384e19c8c1c575db
SHA1 9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66
SHA512 876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e
SSDEEP 1536:FmkHcmHFtBJPtyii8Pywn0aA8O0OxWZZiliPvkxndZNrb7:gkHVRmYRTO3MnYdZNf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RWLN.dll

Path C:\Users\Admin\AppData\Local\Temp\RWLN.dll
Size 325KB
SHA256 7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74
MD5 cf6ce6b13673dd11f0cd4b597ac56edb
SHA1 2017888be6edbea723b9b888ac548db5115df09e
SHA512 e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc
SSDEEP 6144:uxSZqS3pxocUfrzq5q0TAdRr0ueqS90F:uxS73pxocCrzIn80uJS90F
MD5 SHA1 SHA512 SSDEEP

Submit Download

de.exe

Path C:\Users\Admin\AppData\Local\Temp\de.exe
Size 98KB
SHA256 cdb8330b9a36462dad63fb5c98520c4dd1cecf8a20d071bb0eff15ecf9fe0c98
MD5 b8622a3042d7fa48b2e6de433007c870
SHA1 6399b9d115c3f1d3c5469f81b1a821bf75b75ae8
SHA512 19450e826c78cc9526bf9ccba356fa63c8282ae3093db9ad71c1f21bcd80b3850b3aabbd2221fd6ddc293378df3d52ac0484c8882aeee517145d018ce3b4ed73
SSDEEP 3072:JWcZvNlEpqqJ7QkHJt2NvSx2felU2NJrIzT:JWAOpTJ7QkpkfelNJrIzT
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfOggMux.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll
Size 84KB
SHA256 ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e
MD5 65889701199e41ae2abee652a232af6e
SHA1 3f76c39fde130b550013a4f13bfea2862b5628cf
SHA512 edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5
SSDEEP 1536:Yv53t9OUu7EzZX7tHiDrasYb2jdNj4OgLDEzf4:Yv599OUuwzZlcrasw2jdN0OgLD84
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfTheoraEncoder.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll
Size 240KB
SHA256 f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f
MD5 5f2fc8a0d96a1e796a4daae9465f5dd6
SHA1 224f13f3cbaa441c0cb6d6300715fda7136408ea
SHA512 da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad
SSDEEP 3072:CGqLgUQzyZTXg7nO2kIVA41cweQXrDRX5GBVE3NPEc8Vf1Uk58R9aAwQfzlLd07C:NOQzPO2kwwwXXSHEtlsaXucOjFDIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfVorbisEncoder.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll
Size 1.6MB
SHA256 2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282
MD5 086a9fd9179aad7911561eeff08cf7e2
SHA1 d390c28376e08769a06a4a8b46609b3a668f728b
SHA512 a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193
SSDEEP 6144:+Je5f8/yevmbiW/cV+kcBGWzR0FZOAoDG:pJ8/yevmbiSckno
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 4KB
SHA256 41e65323386d46854c2d47721abc6cd07cf0932912e79637a8d663d2dcb5c465
MD5 011f14a1a59c0c446f5d0f6c168ed1f7
SHA1 cff018bc19278be9b73419a67cddee9831f9e9a4
SHA512 c5d9fa8049afe0fe772098dd3b9e46349dcfc01452de7d9128a2b7556a62d406ad861ef34e084659d193b6c38c66530b6236d22f90a9a2e8a530cb78ed133332
SSDEEP 96:Y2t0ycyhhjuhZI3fybhdLs5+UsuHMHq48bwkYZf8PPp:Ys0hejIZI3fE58fa8b/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mes.js

Path C:\Users\Admin\AppData\Local\Temp\mes.js
Size 154B
SHA256 49d4efe001243866edc91f8f9fd6231e1602bcfcab4e508d23d0cb5e68ea35c2
MD5 0bf43169d817f42c7ccf55ddf2940d55
SHA1 d3c84dfc613a1c635de464a633d1678cac60bcf9
SHA512 c647cebbed6693e89c4592cb5565011c8831329ada1f8cb5714640264484ca38ac9146db1f2dc948bcf53e12e79c9a2ded44a8c09eb30d60d14a1ec8c34ab605
MD5 SHA1 SHA512

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp80.dll
Size 541KB
SHA256 384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
MD5 8c53ccd787c381cd535d8dcca12584d8
SHA1 bc7ce60270a58450596aa3e3e5d0a99f731333d9
SHA512 e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755
SSDEEP 12288:UZY4lOHMwLwXBt+ia3htSUa/hUgiW6QR7t5j3Ooc8NHkC2eSQ:UZY4lOHMM8wiShtSj3Ooc8NHkC2eT
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcr80.dll
Size 617KB
SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
MD5 1169436ee42f860c7db37a4692b38f0e
SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
SSDEEP 12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
Size 2.8MB
SHA256 579e5984ad5eb6e5e4b004acd01c95f609a1330f3900cd9851562eb4ac879197
MD5 a90c6e72a9e2602560c521a1647664ad
SHA1 22f7f0ddb0af04df7109c3ddbb7027909041fa73
SHA512 fbba623cab28c0648e8bdd03c99df9e2a84180d72ea8e63367e943f8b432ebc36a7e10a8bfce11ad1803e54a8514f1ded4fec72e680ee04386965b5eb6a5d6c2
SSDEEP 49152:AmG6nzSTLQynAc4oitsUj17bFhNkYZTGQnMICLddx:AmGPLTuoiDnB5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Local\Temp\rutserv.exe
Size 3.2MB
SHA256 b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57
MD5 62dbd11dc36780e35af1aafaa6a8f0f1
SHA1 dc6aaac7171b351be3397c3e0e1769dffa848723
SHA512 b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d
SSDEEP 49152:AN0bCGfSU5AGMfdpDXXR6+ju3cHbFilnut1rfkvIklc9JT/TvogiL8sZddxSD:AN68rGnuzrfkvjcdiL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Users\Admin\AppData\Local\Temp\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

set.reg

Path C:\Users\Admin\AppData\Local\Temp\set.reg
Size 14KB
SHA256 7fe151bd0f7bd7a2f9558eeb4ed54e2070e2a9c233e6445a24a8891fd72d1f01
MD5 0f47a01e21911e8cbfd6903bbf4579d8
SHA1 7fbc72f0a91c73f96dc056942d080911ff617a13
SHA512 5606535a4f51f4dc564fd972fea0d8cdd0ac79f2c1bea3c26b24984fb0068fba20479533c57c582af8572565c981939626a0c6bca298d57bd5785ef02b6515d8
SSDEEP 384:BHc/pvG3asLMvyV2f5etUmCLCJ1j6kpETt5aENBJsjxqTIpBpG7PRmH6eN:BHc/p8asLMvyVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

stop.js

Path C:\Users\Admin\AppData\Local\Temp\stop.js
Size 215B
SHA256 fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406
MD5 804b35ef108ec9839eb6a9335add8ca1
SHA1 bf91e6645c4a1c8cab2d20388469da9ed0a82d56
SHA512 822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d
MD5 SHA1 SHA512

Submit Download

memory/1220-102-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Download

memory/1220-106-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Download

memory/1220-105-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/1944-139-0x0000000000920000-0x0000000000978000-memory.dmp

Download

memory/1944-117-0x0000000000920000-0x0000000000978000-memory.dmp

Download

memory/1944-138-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/2340-152-0x0000000000400000-0x000000000075E000-memory.dmp

Download

memory/2340-137-0x00000000007D0000-0x0000000000828000-memory.dmp

Download

memory/2340-153-0x00000000007D0000-0x0000000000828000-memory.dmp

Download

memory/2440-150-0x0000000000400000-0x000000000075E000-memory.dmp

Download

memory/2440-133-0x0000000000B10000-0x0000000000B68000-memory.dmp

Download

memory/2440-151-0x0000000000B10000-0x0000000000B68000-memory.dmp

Download

memory/3116-166-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3116-154-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3116-148-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3116-160-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3116-172-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3116-121-0x0000000000860000-0x00000000008B8000-memory.dmp

Download

memory/3116-149-0x0000000000860000-0x00000000008B8000-memory.dmp

Download

memory/3488-146-0x0000000000400000-0x000000000075E000-memory.dmp

Download

memory/3488-147-0x0000000000880000-0x00000000008D8000-memory.dmp

Download

memory/3488-145-0x0000000000880000-0x00000000008D8000-memory.dmp

Download

memory/3508-111-0x0000000000400000-0x00000000007C6000-memory.dmp

Download

memory/3508-112-0x00000000008F0000-0x0000000000948000-memory.dmp

Download

memory/3508-110-0x00000000008F0000-0x0000000000948000-memory.dmp

Download