Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
26/07/2024, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
22 signatures
150 seconds
General
- Target 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
- Size 5.0MB
- Sample240726-csqq4azgpk
- SHA256 d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec
- MD5 723a7e3f2a293f526c2574cfad06b72b
- SHA1 54c9a81aa53962beb066402e63464f7b18d34273
- SHA512 a4183af1435af07da77d96ca992190d06d5c5bda37528a5c5a4aeb811aedaa6c26ebaa7d26347d066d92ce60f11e2c893b5ed0526e71daebd8d65aca2afdc70b
- SSDEEP 98304:YogY3IgMAk7BepFZXiWDoFA9hvfbDU+epbQ9DgG6O2kF2KaQ+02usPfdN:YS3IRRwp/Xi+KAjffU+epbytUkF9aQ+V
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe - Executes dropped EXE 7 IoCs
pid Process 4772 rutserv.exe 5336 rutserv.exe 5464 rutserv.exe 5600 rutserv.exe 5732 rfusclient.exe 5724 rfusclient.exe 3280 rfusclient.exe - Loads dropped DLL 1 IoCs
pid Process 2528 MsiExec.exe - Blocklisted process makes network request 2 IoCs
flow pid Process 63 1064 msiexec.exe 66 1064 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe - Drops file in Program Files directory 17 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html rutserv.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html rutserv.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Microsoft.VC90.CRT.manifest msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC6DB.tmp msiexec.exe File created C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\Installer\e57c2c3.msi msiexec.exe File opened for modification C:\Windows\Installer\e57c2c3.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e57c2c7.msi msiexec.exe File opened for modification C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC592.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B04BFE4C-7F11-49D8-ADFE-867939D886FA} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4984 PING.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF\Remote_Office_Manager msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\PackageCode = "3041FA689ACC3184E99A4B5081B5660B" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductIcon = "C:\\Windows\\Installer\\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\C4EFB40B11F78D94DAEF6897938D68AF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Version = "100600760" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\PackageName = "rms.host5.3ru.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media msiexec.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4984 PING.EXE - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1988 msedge.exe 1988 msedge.exe 3028 msedge.exe 3028 msedge.exe 1064 msiexec.exe 1064 msiexec.exe 2692 identity_helper.exe 2692 identity_helper.exe 4772 rutserv.exe 4772 rutserv.exe 5336 rutserv.exe 5336 rutserv.exe 5464 rutserv.exe 5464 rutserv.exe 5600 rutserv.exe 5600 rutserv.exe 5600 rutserv.exe 5600 rutserv.exe 5600 rutserv.exe 5600 rutserv.exe 5724 rfusclient.exe 5724 rfusclient.exe 5888 msedge.exe 5888 msedge.exe 5888 msedge.exe 5888 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe - Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 3280 rfusclient.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1320 msiexec.exe Token: SeIncreaseQuotaPrivilege 1320 msiexec.exe Token: SeSecurityPrivilege 1064 msiexec.exe Token: SeCreateTokenPrivilege 1320 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1320 msiexec.exe Token: SeLockMemoryPrivilege 1320 msiexec.exe Token: SeIncreaseQuotaPrivilege 1320 msiexec.exe Token: SeMachineAccountPrivilege 1320 msiexec.exe Token: SeTcbPrivilege 1320 msiexec.exe Token: SeSecurityPrivilege 1320 msiexec.exe Token: SeTakeOwnershipPrivilege 1320 msiexec.exe Token: SeLoadDriverPrivilege 1320 msiexec.exe Token: SeSystemProfilePrivilege 1320 msiexec.exe Token: SeSystemtimePrivilege 1320 msiexec.exe Token: SeProfSingleProcessPrivilege 1320 msiexec.exe Token: SeIncBasePriorityPrivilege 1320 msiexec.exe Token: SeCreatePagefilePrivilege 1320 msiexec.exe Token: SeCreatePermanentPrivilege 1320 msiexec.exe Token: SeBackupPrivilege 1320 msiexec.exe Token: SeRestorePrivilege 1320 msiexec.exe Token: SeShutdownPrivilege 1320 msiexec.exe Token: SeDebugPrivilege 1320 msiexec.exe Token: SeAuditPrivilege 1320 msiexec.exe Token: SeSystemEnvironmentPrivilege 1320 msiexec.exe Token: SeChangeNotifyPrivilege 1320 msiexec.exe Token: SeRemoteShutdownPrivilege 1320 msiexec.exe Token: SeUndockPrivilege 1320 msiexec.exe Token: SeSyncAgentPrivilege 1320 msiexec.exe Token: SeEnableDelegationPrivilege 1320 msiexec.exe Token: SeManageVolumePrivilege 1320 msiexec.exe Token: SeImpersonatePrivilege 1320 msiexec.exe Token: SeCreateGlobalPrivilege 1320 msiexec.exe Token: SeShutdownPrivilege 2940 msiexec.exe Token: SeIncreaseQuotaPrivilege 2940 msiexec.exe Token: SeCreateTokenPrivilege 2940 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2940 msiexec.exe Token: SeLockMemoryPrivilege 2940 msiexec.exe Token: SeIncreaseQuotaPrivilege 2940 msiexec.exe Token: SeMachineAccountPrivilege 2940 msiexec.exe Token: SeTcbPrivilege 2940 msiexec.exe Token: SeSecurityPrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeLoadDriverPrivilege 2940 msiexec.exe Token: SeSystemProfilePrivilege 2940 msiexec.exe Token: SeSystemtimePrivilege 2940 msiexec.exe Token: SeProfSingleProcessPrivilege 2940 msiexec.exe Token: SeIncBasePriorityPrivilege 2940 msiexec.exe Token: SeCreatePagefilePrivilege 2940 msiexec.exe Token: SeCreatePermanentPrivilege 2940 msiexec.exe Token: SeBackupPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeShutdownPrivilege 2940 msiexec.exe Token: SeDebugPrivilege 2940 msiexec.exe Token: SeAuditPrivilege 2940 msiexec.exe Token: SeSystemEnvironmentPrivilege 2940 msiexec.exe Token: SeChangeNotifyPrivilege 2940 msiexec.exe Token: SeRemoteShutdownPrivilege 2940 msiexec.exe Token: SeUndockPrivilege 2940 msiexec.exe Token: SeSyncAgentPrivilege 2940 msiexec.exe Token: SeEnableDelegationPrivilege 2940 msiexec.exe Token: SeManageVolumePrivilege 2940 msiexec.exe Token: SeImpersonatePrivilege 2940 msiexec.exe Token: SeCreateGlobalPrivilege 2940 msiexec.exe Token: SeShutdownPrivilege 3608 msiexec.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1320 msiexec.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 1320 msiexec.exe 2940 msiexec.exe 2940 msiexec.exe 5732 rfusclient.exe 5732 rfusclient.exe 5732 rfusclient.exe 5732 rfusclient.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 3028 msedge.exe 5732 rfusclient.exe 5732 rfusclient.exe 5732 rfusclient.exe 5732 rfusclient.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 3028 1436 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe 87 PID 1436 wrote to memory of 3028 1436 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe 87 PID 3028 wrote to memory of 3824 3028 msedge.exe 88 PID 3028 wrote to memory of 3824 3028 msedge.exe 88 PID 1436 wrote to memory of 3280 1436 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe 89 PID 1436 wrote to memory of 3280 1436 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe 89 PID 1436 wrote to memory of 3280 1436 723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe 89 PID 3280 wrote to memory of 320 3280 cmd.exe 91 PID 3280 wrote to memory of 320 3280 cmd.exe 91 PID 3280 wrote to memory of 320 3280 cmd.exe 91 PID 3280 wrote to memory of 1320 3280 cmd.exe 92 PID 3280 wrote to memory of 1320 3280 cmd.exe 92 PID 3280 wrote to memory of 1320 3280 cmd.exe 92 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1148 3028 msedge.exe 93 PID 3028 wrote to memory of 1988 3028 msedge.exe 94 PID 3028 wrote to memory of 1988 3028 msedge.exe 94 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95 PID 3028 wrote to memory of 1620 3028 msedge.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rmansys.ru/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8eda246f8,0x7ff8eda24708,0x7ff8eda247183⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:23⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:83⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:13⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:13⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:83⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:13⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:13⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:13⤵PID:5364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:13⤵PID:5372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
- System Location Discovery: System Language Discovery
PID:320
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1320
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /x {B04BFE4C-7F11-49D8-ADFE-867939D886FA} /passive REBOOT=ReallySuppress3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2940
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4984
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /I "rms.host5.3ru.msi" /qn3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4180
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 81A7596BCC1895F35162BFC3E9FE135B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2528
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4772
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5336
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5464
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5600 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5724 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:3280
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5732
-
Network
MITRE ATT&CK Enterprise v15
Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57c2c6.rbs
- Size 15KB
- SHA256 3b24b97907bee4ce4f4c6582ea7f9f0bc1e81ab7cb3aa804675a1c811e0fa02e
- MD5 a8a368ffe05d7cae78839aa54318d125
- SHA1 ab241587b29bed7dafb0c5d4d15062c06a375235
- SHA512 c494edd6e70ce729d2280a4cc530537aae50fcf2ba2b860b812a3f564badf0a2c31245d58d24bcaedad3139da1059e113a2d89757321759cbf32076f1b46c3d3
- SSDEEP 192:tn8tQz9MQ3URkA6sdVo9sZtt1APSYJWSYm241tVUnbpAFf:t8ty+QWmwt6SNSDB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\English.lg
- Size 42KB
- SHA256 5572df7bedc2b0d0812643af2c8ee03eaba744df3f01940207122426d2a21339
- MD5 1239f13726dd9ed2741688b28bec9c01
- SHA1 f960677a139da7d7c758330510b43028377a9bf7
- SHA512 89835f0d6a7453c25432e0d7f0072b9c89558bd567ac81cfa726cf638598e07b282e8df17f5068bcfe54843a696463a0276a9bb68cdb0daabce563f9a2a45ad5
- SSDEEP 384:aKrjWualU4EyY1DNsn9Q7WAuUhByl6yzsOO+sEs1TP:gu2g6bUhByl6Vp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll
- Size 144KB
- SHA256 379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90
- MD5 30e269f850baf6ca25187815912e21c5
- SHA1 eb160de97d12b4e96f350dd0d0126d41d658afb3
- SHA512 9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7
- SSDEEP 1536:s6nhB/omNBB+rJ7lxGh/7+zc2Xg+Kmf231/LdkNBcgMrQHMIYC25kKAYP:s6nhB/pf/nxBJkpMrQp2klI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll
- Size 357KB
- SHA256 d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077
- MD5 bb1f3e716d12734d1d2d9219a3979a62
- SHA1 0ef66eed2f2ae45ec2d478902833b830334109cb
- SHA512 bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c
- SSDEEP 6144:m3Gyn6PR//b27X8eFU8AiL9n3J3Lz6C2+vlHNfjJB3:mWyn6PR/yD3Rv6C2wh3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg
- Size 47KB
- SHA256 d2fe39c745748bf73f16367893d6ce4329dc68a68e6c79acc0ed0a240300a936
- MD5 83d34dbe5ec48888b06d471ee12ab9fe
- SHA1 4c6d12ac5a4d3f668b3e58d02d69b0af6559fb47
- SHA512 ddce22974a5bfe4ee32d100b05d4b01661e0e51e6e5b27595220a3edac2aa31d90b5389cb33cd492e38126732eac247664b8d93f883399d73f84e6858affec4d
- SSDEEP 384:PKS6FpsTkMiUUadzbnYwu6GXxKdwBzMlcvN7sY:OsTkT2YKdwBhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll
- Size 234KB
- SHA256 528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8
- MD5 8e3f59b8c9dfc933fca30edefeb76186
- SHA1 37a78089d5936d1bc3b60915971604c611a94dbd
- SHA512 3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d
- SSDEEP 6144:xNGNGz3L83EnfDY8qWn1WR02I1oOtsDoF:KS3LuEnfDY8qWwDI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll
- Size 1.6MB
- SHA256 1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf
- MD5 ff622a8812d8b1eff8f8d1a32087f9d2
- SHA1 910615c9374b8734794ac885707ff5370db42ef1
- SHA512 1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931
- SSDEEP 6144:KTxkwbOX8SMTmmqrN2VwJ1agkR0dM7OtSDD:KTxkeOX8SMTmmqR2VwJ1R87
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll
- Size 1.6MB
- SHA256 f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645
- MD5 871c903a90c45ca08a9d42803916c3f7
- SHA1 d962a12bc15bfb4c505bb63f603ca211588958db
- SHA512 985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145
- SSDEEP 24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll
- Size 556KB
- SHA256 4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01
- MD5 b2eee3dee31f50e082e9c720a6d7757d
- SHA1 3322840fef43c92fb55dc31e682d19970daf159d
- SHA512 8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3
- SSDEEP 12288:iZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8bw:iZSZ13iwJmgLq83Ooc8SHkC2efw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll
- Size 637KB
- SHA256 e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099
- MD5 7538050656fe5d63cb4b80349dd1cfe3
- SHA1 f825c40fee87cc9952a61c8c34e9f6eee8da742d
- SHA512 843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8
- SSDEEP 12288:shr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyvRt:cU9FNPPbxPP2OeL9Q2pUmRyyvRt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
- Size 3.9MB
- SHA256 6784ad757bc2ffd189a11dfb627ea43596b4ad66a62217a5e22f509bdb4bd09d
- MD5 8887cd8cf57b949ecc28a28eff53be4d
- SHA1 03e2f01ae0342257f743f354e331a527356a3048
- SHA512 3e784a7bd945b077ea955ec3419361c9a757865750b520ab3e99cab2660120c4b27ed1b0b29e4566788eba46fd5a2d72be4c6972611f8ae3528d840eb60fb415
- SSDEEP 49152:P9SgR7N8yTr33SqLpkWpeT+CHolIPmXg2HSRGNh8TETiWkdHGgddxm6D6:P9S4xP0wg2H5j06
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
- Size 5.1MB
- SHA256 7cdc4543bf05da7c2f25048169c338035dec83155ead1d7d08ebb13a1e34f032
- MD5 38daaf395100a422806f0c7398fe5142
- SHA1 493b0f2f9e2af05698ef9862bcef49f40cca8be4
- SHA512 892dc4647d7a3f2d67d9b32905a3dfbf729145320cf8384ecd32e3ead4f42563c0b0a94a6086fd23e0850999ec7276f4037a7285804ed8ec224467e3cb591c0d
- SSDEEP 49152:CYtYRBXdAZ63TCSPM1pG8TDLHiBTYBHabN4cFxju6RirYuTt1VNHOzsgTRTtU2uT:CQY3mZ4TYBHaBD1u69uTfVNHOzsNZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll
- Size 403KB
- SHA256 5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51
- MD5 6f6bfe02e84a595a56b456f72debd4ee
- SHA1 90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2
- SHA512 ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50
- SSDEEP 6144:TtRCO98lHWxT9X9VDvQ5jVhHprycryFY8F/yEJkQFxQC9t7P4Y4fdoe:xRCblq3VDvaZ8nSQp9tPJ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll
- Size 685KB
- SHA256 519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8
- MD5 c638bca1a67911af7f9ed67e7b501154
- SHA1 0fd74d2f1bd78f678b897a776d8bce36742c39b7
- SHA512 ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f
- SSDEEP 12288:+egptt4e4Fn1D+VE2amSNJ1YN6ttEUxjoYVxsubVLTuejlnhkeVhGZ6q:znhiE2amSNJGN6t+UvVxsILTfnhBGv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
- MD5 3ee50fb26a9d3f096c47ff8696c24321
- SHA1 a8c83e798d2a8b31fec0820560525e80dfa4fe66
- SHA512 479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
- MD5 eaaad45aced1889a90a8aa4c39f92659
- SHA1 5c0130d9e8d1a64c97924090d9a5258b8a31b83c
- SHA512 0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 192B
- SHA256 47b4de8dd95686f083f442fb57e91bbde6f9be8e21704056178ec81de88680a0
- MD5 0cc2c378583c9c23b925aa6416c1db41
- SHA1 d4dfeb7a044962ce18887996678ec19f0b0a3abe
- SHA512 e231fe9bd8a9b85ebf2d55487fa1b91b252dc9ff7b96859a99f2d55ec244866b6405a2a455d014490955982a554e690f373b5aeab20fa5f474eca2a468385624
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 4b5a84066fed2f0f8e6e4d5d9a939ecd2ed160b6670b6c7e80f9a3e3a0c7dacb
- MD5 e54245c5c05250865ba8cc5d35bdfcfe
- SHA1 ccf42a5db21cdcdcc2369fb6fb9c4d6f272bb19e
- SHA512 1546511d77f1bca7a9a55e9f137fde573e260ac75f19aa590072d414fef83fabc175df0e1dba5399a9eae5ca9d36acc5c322d2d859023774cda283561e208ef4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 703c4ef0d4c2a6fdea6fb33663c8975d823b2dcc5ec62de346dbbd6d779e8f5f
- MD5 10c49af66ad661ecbcedf6963e7a299d
- SHA1 3179baad5ce0ab33b149fbd6c2f1824b9c6d9924
- SHA512 757dcedcfb2d01bc66f91fe0481eb217d792af43047809839167c3f56e050109bafae40ba84bb84c5dccd48cf0ba85cf28aa9654c827e1367c50e6560c901ba7
- SSDEEP 96:nQkFj1e/2wpvWMoiVmdeONuXJ1c6esEVN8GY42qm0O9UWQyV+VD7AiEwb:nQkpouGWM0uZW6pEVNy42Zrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3041b7d36b271c588d95ec7503a31b6f1d6cd5611c8b12dac376143d628ea8e8
- MD5 40e524ecd2969d8596a3d91f235f343a
- SHA1 6c7fb4e3062c06d1e5aa96e895106e41b58b7c54
- SHA512 517284df7e652e71b741b6aa34c69d7e65790a0b7f2ccd04b220bb364759861c0b5d78190ee012543bfcf505c266191a13b18f39e50b08c1e4d0df060725d314
- SSDEEP 96:nQkOj1e92wpvWMoiVmdeHqmm9UWQyV+VDCziEwb:nQk0oQGWMXAro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 706B
- SHA256 291c53cdcb9a31456f95f61b33c7aad73f46474a500e19eecf55cfd25946de09
- MD5 fa84d2adac4119c4a82fbe70eaf2073d
- SHA1 34cb09098de5d0db64b949e036ecabdd40969e8b
- SHA512 a1a7295fd98065275c4724a2b14db680d826742772af8325bf24fe6a71ce42ee5e392cc6ddce6150fcb0c7ff6468f0c84c7d0dea5bada88025ece595e359624f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a59.TMP
- Size 706B
- SHA256 f3c5f4779209f4b85e90dc2a409cd0009ffc7919db9451912ec10ff569ad7ea9
- MD5 cef3b576b0dcfb8276ef561a27e0dd17
- SHA1 e291d51c868cd6df92a64eb334be468f77f35445
- SHA512 e133aaa4049789b52215973de08562257407dc26376f7247b8a81b14195bcea0da65533dd6dfabc586cb846c69d06b3e34d3857c30601c71114746db09f67830
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 6c9f83991f51b5c720549666d59faea14a21d06c9cc3f98fcf0887b47f28ccc9
- MD5 23e10177ea8231d5008b09419726f3c1
- SHA1 b68c2c99c3780b8dbcb94ad229105f1d2f0a17b3
- SHA512 ea38930b42f594bbff1598b388a5f24230179093169e7a436c4738c4bc09e660c59e05481bc0038576cc4cf6673638dde5afe8426f141f906512d5dd10d2cd04
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupge2RUuJODCpFXWx3kl0g:A9iIxuERzA83h09RZxY+IqQ3kl0g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd
- Size 232B
- SHA256 4d235c009676193204f8a0d045c49e08cd6c78e678469a2d899f95bdcf570347
- MD5 b3adc7c65dcbf585c21d00469c8a6c49
- SHA1 58fb948da679d30a718dad186275d3a02045b9d5
- SHA512 b42f41d205d971e4cc30ec9230e3951f5a1e9671739f37e3e8a21732b258cd7256021cae16ef07eb68288e35f07284dd19016f8c59f7886418cd5e37842d526d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host5.3ru.msi
- Size 5.7MB
- SHA256 dbcc5a754b8685e18702a4e28adc6952a3df2ef52bbaafc8c0dc9ea6a4444e86
- MD5 fe42b2a6ae84bbb706d72e17d38e0f2e
- SHA1 942b308cb85cc06199427e0d40bc44f8705aabf8
- SHA512 fc42bc8216ae12b5231af94ae705ed9854faf4d91b9bdaaa087751383b689e665101d922be68609072a70cdde3f5079e55acf76e095b3cc75954030098604983
- SSDEEP 98304:nYyEw7NII8nGnAPyAqE/gYLN3LO8xbkTtBZFw78apzA8Q6Qz:+2WfnG6l/9O8VkxlYFp83z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIC592.tmp
- Size 125KB
- SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
- MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
- SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
- SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
- SSDEEP 1536:o2/dai5RmZDDeTITe2DClwhJwyxncO6Nyc/ldjTbl1gO:bai5RIWTybwyxnchNyc/ldj/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe
- Size 96KB
- SHA256 b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
- MD5 9e2c097647125ee25068784acb01d7d3
- SHA1 1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
- SHA512 e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
- SSDEEP 1536:cdU81cOXdrITHGKhoa+5g0SzIV8Q5B5yx5lJlieKVL:8jcnmZ5g0SzkB5Q5V6V
- MD5 SHA1 SHA512 SSDEEP