rms | 86c220d1b73c3ed1d84330e4d34f8ddb993177da3d7e33b5de8b24a458ac7ab9

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
Size

4.9MB
MD5

e09ce4c6815db9a8954928be18b9e3ad
SHA1

2c82f757cf8fc537b622ae93b9bdb9cc6eebd5ef
SHA256

86c220d1b73c3ed1d84330e4d34f8ddb993177da3d7e33b5de8b24a458ac7ab9
SHA512

adf8296af4744b594afe5fc701b501c80886e35ad6c84a54f1f7836073b087e73b36568bac662091c1124c7d6915a1b2196c9387c02521319a1eef0dddbffd70
SSDEEP

98304:A+PzP5iw0yhm0J5t8s6kheKqno3KzKWNXblVE3MlYJ4DcLIQeXRxk5oi:AQL5F0mm0nus/sKGoaOWNXbEpJ4I6k5T

Score

10^/10

rms discovery evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2920	attrib.exe

Executes dropped EXE 10 IoCs

Processes:

rfusclient.exerutserv.exerfusclient.exerutserv.exerfusclient.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
2020	rfusclient.exe
848	rutserv.exe
2704	rfusclient.exe
2756	rutserv.exe
684	rfusclient.exe
3012	rutserv.exe
2828	rutserv.exe
864	rfusclient.exe
2664	rfusclient.exe
2232	rfusclient.exe

Loads dropped DLL 21 IoCs

Processes:

MsiExec.exeMsiExec.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
1788	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2020	rfusclient.exe
2020	rfusclient.exe
2020	rfusclient.exe
2020	rfusclient.exe
2020	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
1788	MsiExec.exe
684	rfusclient.exe
684	rfusclient.exe
684	rfusclient.exe
684	rfusclient.exe

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow	pid	Process
3	2076	msiexec.exe
5	2076	msiexec.exe
7	2076	msiexec.exe
9	2076	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 16 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\gdiplus.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf	msiexec.exe

Drops file in Windows directory 21 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76d2bd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d2ba.msi	msiexec.exe
File created	C:\Windows\Installer\f76d2bd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5BB.tmp	msiexec.exe
File created	C:\Windows\Installer\f76d2bf.msi	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File created	C:\Windows\Installer\f76d2ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF63A.tmp	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBC9.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

PING.EXEMsiExec.exerutserv.exerutserv.exerfusclient.exee09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exechcp.comMsiExec.exemsiexec.exemsiexec.exerfusclient.exerutserv.exerfusclient.exereg.execmd.exerutserv.exeattrib.exereg.exerfusclient.exerfusclient.exemsiexec.exerfusclient.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
2668	PING.EXE

Modifies data under HKEY_USERS 12 IoCs

Processes:

rfusclient.exerfusclient.exemsiexec.exerfusclient.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F1-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "Webm.VP8Decoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID\ = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8decoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F4-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisEncoder.dll"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FilterData = 02000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000080000000900000003174793300000000a0000000b00000003274793300000000a0000000c00000003170693308000000000000000100000000000000000000003074793300000000a0000000d0000000131789604fc26747b6c96ca05b3338fc8eeb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a0bd12f8d41586b4a8905588fec1aded90100000000001000800000aa00389b71	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer\ = "WebM.VP8Encoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Version = "83951616"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "WebM.VP8Encoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000200002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b715650383000001000800000aa00389b71	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisDecoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\ = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FriendlyName = "Xiph.Org Vorbis Decoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2668	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

msiexec.exerutserv.exerfusclient.exe

pid	Process
2076	msiexec.exe
2076	msiexec.exe
2828	rutserv.exe
2828	rutserv.exe
864	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid	Process
2232	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	1280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1280	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2076	msiexec.exe
Token: SeCreateTokenPrivilege	1280	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1280	msiexec.exe
Token: SeLockMemoryPrivilege	1280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1280	msiexec.exe
Token: SeMachineAccountPrivilege	1280	msiexec.exe
Token: SeTcbPrivilege	1280	msiexec.exe
Token: SeSecurityPrivilege	1280	msiexec.exe
Token: SeTakeOwnershipPrivilege	1280	msiexec.exe
Token: SeLoadDriverPrivilege	1280	msiexec.exe
Token: SeSystemProfilePrivilege	1280	msiexec.exe
Token: SeSystemtimePrivilege	1280	msiexec.exe
Token: SeProfSingleProcessPrivilege	1280	msiexec.exe
Token: SeIncBasePriorityPrivilege	1280	msiexec.exe
Token: SeCreatePagefilePrivilege	1280	msiexec.exe
Token: SeCreatePermanentPrivilege	1280	msiexec.exe
Token: SeBackupPrivilege	1280	msiexec.exe
Token: SeRestorePrivilege	1280	msiexec.exe
Token: SeShutdownPrivilege	1280	msiexec.exe
Token: SeDebugPrivilege	1280	msiexec.exe
Token: SeAuditPrivilege	1280	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1280	msiexec.exe
Token: SeChangeNotifyPrivilege	1280	msiexec.exe
Token: SeRemoteShutdownPrivilege	1280	msiexec.exe
Token: SeUndockPrivilege	1280	msiexec.exe
Token: SeSyncAgentPrivilege	1280	msiexec.exe
Token: SeEnableDelegationPrivilege	1280	msiexec.exe
Token: SeManageVolumePrivilege	1280	msiexec.exe
Token: SeImpersonatePrivilege	1280	msiexec.exe
Token: SeCreateGlobalPrivilege	1280	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe
Token: SeLockMemoryPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeMachineAccountPrivilege	2148	msiexec.exe
Token: SeTcbPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeLoadDriverPrivilege	2148	msiexec.exe
Token: SeSystemProfilePrivilege	2148	msiexec.exe
Token: SeSystemtimePrivilege	2148	msiexec.exe
Token: SeProfSingleProcessPrivilege	2148	msiexec.exe
Token: SeIncBasePriorityPrivilege	2148	msiexec.exe
Token: SeCreatePagefilePrivilege	2148	msiexec.exe
Token: SeCreatePermanentPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeDebugPrivilege	2148	msiexec.exe
Token: SeAuditPrivilege	2148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2148	msiexec.exe
Token: SeChangeNotifyPrivilege	2148	msiexec.exe
Token: SeRemoteShutdownPrivilege	2148	msiexec.exe
Token: SeUndockPrivilege	2148	msiexec.exe
Token: SeSyncAgentPrivilege	2148	msiexec.exe
Token: SeEnableDelegationPrivilege	2148	msiexec.exe
Token: SeManageVolumePrivilege	2148	msiexec.exe
Token: SeImpersonatePrivilege	2148	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.execmd.exemsiexec.exerfusclient.exerfusclient.exe

description	pid	Process	procid_target
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 1236 wrote to memory of 760	1236	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	30
PID 760 wrote to memory of 2332	760	cmd.exe	32
PID 760 wrote to memory of 2332	760	cmd.exe	32
PID 760 wrote to memory of 2332	760	cmd.exe	32
PID 760 wrote to memory of 2332	760	cmd.exe	32
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 1280	760	cmd.exe	33
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2148	760	cmd.exe	35
PID 760 wrote to memory of 2668	760	cmd.exe	36
PID 760 wrote to memory of 2668	760	cmd.exe	36
PID 760 wrote to memory of 2668	760	cmd.exe	36
PID 760 wrote to memory of 2668	760	cmd.exe	36
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 760 wrote to memory of 2700	760	cmd.exe	38
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 1788	2076	msiexec.exe	39
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2968	2076	msiexec.exe	40
PID 2076 wrote to memory of 2020	2076	msiexec.exe	41
PID 2076 wrote to memory of 2020	2076	msiexec.exe	41
PID 2076 wrote to memory of 2020	2076	msiexec.exe	41
PID 2076 wrote to memory of 2020	2076	msiexec.exe	41
PID 2020 wrote to memory of 848	2020	rfusclient.exe	42
PID 2020 wrote to memory of 848	2020	rfusclient.exe	42
PID 2020 wrote to memory of 848	2020	rfusclient.exe	42
PID 2020 wrote to memory of 848	2020	rfusclient.exe	42
PID 2076 wrote to memory of 2704	2076	msiexec.exe	43
PID 2076 wrote to memory of 2704	2076	msiexec.exe	43
PID 2076 wrote to memory of 2704	2076	msiexec.exe	43
PID 2076 wrote to memory of 2704	2076	msiexec.exe	43
PID 2704 wrote to memory of 2756	2704	rfusclient.exe	44
PID 2704 wrote to memory of 2756	2704	rfusclient.exe	44

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2668
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "rms.server5.1rc1ru.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H +r "C:\Program Files\Remote Manipulator System - Server"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2920
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Un install\{11A90858-40BB-4858-A2DA-CA6495B5E907}" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\In staller\UserData\S-1-5-18\Products\85809A11BB0485842AADAC46595B9E70\Insta llProperties" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8B215DE81DC0FF12E4371325EB1F4C1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5C0DCBA0ED0B6D02400993BC4050327 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2968
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:848
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2756
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:684
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3012

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2828
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- - C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:2232
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76d2be.rbs

Filesize
13KB

MD5
a5029ecbe6dcae55978d3b72d2ab986c

SHA1
1620c771c3101747f9535fa6a71385d95f119034

SHA256
5b915172d278f6d4423ec37bec1fa36076a739ae9a5765d30212006da60649fe

SHA512
931bad1c06d7a6c320ff2ce0cb6395554d4f493dd15e381a6876da1da1605cd6bba45bc39392c5ae24832dbed46a31c851c02beab96f689818fe9a66ca7d2e73

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\English.lg

Filesize
37KB

MD5
e1ef3648745ef44d1918a88e37474ef5

SHA1
a39e15b6987b91774cde383f1696fd992483d27d

SHA256
ade7b68cc10a2c95a94972651cb19179cbb53083d335056cb729401c977627fe

SHA512
cf85d807d9e4b279639e63b66b931724ec3bd09339543d9d9489fcc22bba365df4c7fcdd5adae84256de4050bc6d0e0a05717e55bd5c1691d62ef486a9dd8210

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll

Filesize
198KB

MD5
2d62a5dc205c5f211d9d0c9f5c8251dc

SHA1
a9370a99096ad7352e473571081709ea524bc35c

SHA256
a520c69d34f1ea2a26d4ea00e52352c0be22f8b597c8bf1ba5f83c59cfd1a667

SHA512
8a77c0c4190525f9f8a910b51bef096661ac95d8d2bdc407df690c0769fa9ef3f7f7ed4b188d64874a3a27849a2b5c6df838a58319e506de2185407bacf098b9

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll

Filesize
144KB

MD5
5587454f771e9eeee809ec849b598118

SHA1
a8a74bbfa793035b71af4299acc2db490497e944

SHA256
854a0cb21291b21ef793dcb48c2cd00d7504052b0370062e30bea2095722fabd

SHA512
49f9aa16f9b244f28f3a8dd36d4fa8faf299dadba39df7abf3c223d928c355b439a2007a0fa8421417d3cd5b93c9bd2232e5bc8177d5b9e726414531ff3bf4cd

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll

Filesize
357KB

MD5
0455ff0bd915234eb77ebf8bcf14f13d

SHA1
5dfac2f246717e1ecf4c491e79ce32bb26a8172f

SHA256
eb3c0aef125653db6cdc109e9345921b05a8fcec19be927659af02ee0b0b802f

SHA512
889f655d789d32fbd712b119f2db902949189b1bb0aede08d90c58c5fc8e4d4512ade8aecf2e46434175e00a5fd0ce8c083337f16b9ac35393d4c3a23c70622c

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg

Filesize
40KB

MD5
e338b26aeea96f125b008f3ad4763940

SHA1
f661c0060159a941d79e151250f601cafd838f6f

SHA256
61ed483d8e986b43b07df5af969ce103b35b5d55d7c0acd53299a498b01532e9

SHA512
33d521c5dfecbc805e1aed6745ced0209947ec80bc4369369ead9538f82b654a132db213b881b6dd9e33caa9579f1347be1c43431bc605199d01d7b367cf2ab4

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe

Filesize
3.7MB

MD5
169c64af6a6fad5e03c26b3d6f7f53db

SHA1
495caf5425db10102d6cfc71887db93554539f90

SHA256
c0337d4d5897af91947f012d516b298381748a98da8f15e510b635a2c58287ae

SHA512
314ac5a1bfd94db0ef1f4b1e1ed9bce4ee04b71b9d9499dd7a170d918cf298dc9b87016f8254622fb2ad19a31cfb5ba57920d4d552ec7f030e480dbd102819c1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe

Filesize
4.5MB

MD5
d58e55baf0a9a7e045ff2a029c17383e

SHA1
5e2e676fda575fa1a95fe139d7b8b798f07f7bef

SHA256
716fe90b6df477f134b4733df4548202981c9b4ba23439facb3646199f8b8cfe

SHA512
f4d694fbaa525ee09b8123370982b0680cc269d7a05dc7e9b0a887e49ee101f221c6bdfe37201a2448b883a0b8d1c02092220c7ee502ec7b5f05d856378cde8d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
567B

MD5
45b5b5c39d6e6cd939fec6b3044528b7

SHA1
4758708e1b3bf4cbf58b5485c84f8f2b410d8ef3

SHA256
8a618ba16da60ded8e78d9cc8674b6e304187ec2b718ba7e28d5d391b1e8dd39

SHA512
57fa1dd5c79a66a121342953ad30418fed3c4b99e2174c8f77d4a442db33906a26f017060c1179109a6911767e8de996b9c612e981319595fdba5498e18db2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.server5.1rc1ru.msi

Filesize
5.4MB

MD5
6abc982f20e97d6631160b144562d575

SHA1
edd8d108887c45547a9b032512130636843168fa

SHA256
6553c5f533f519b6542a7e0b0899ade8b8c9fa8263c72adc6fa45a8814649fa4

SHA512
e8560b0afa71a8cc91a4e03dc7e36a22a1af8578536e53a6f8f24479b8fb387fd0f893b400adc762b0b59a5e1b35cb1dfbd286ed5a7d24064c6fd26e8c7b5b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD471.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF405.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

Filesize
1KB

MD5
3191b3011a4e7d1319d41945c5cc770b

SHA1
e985a16536f205b5c58a50310a3860df007ac164

SHA256
4c1938092f84eb5f35b9ca3060c3faf4eef047f852d903fcd479ded13ed56e2d

SHA512
7763b1ccfcbcd4faeb2537a161b97844aae417eac46b7ad7fe4018dd109a9c52964b1e9a8b5a8723cb5feeb0588169a49419ab77dc6de125a40b04afebce21cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

Filesize
1KB

MD5
6177d1d6c3c98c6a693b37860f30ea6b

SHA1
82c5f128489a1a194aaa6db641a2e8cf4e560f5b

SHA256
0903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76

SHA512
fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

Filesize
1KB

MD5
a326927fc5c5b40517642a5c1e1fcc08

SHA1
7c44080ecf01293443a95a93aad965aa59698369

SHA256
3e7982c5eb7c0ce065f4b66c622a73e5d687ec34ba5633fabf593cdc563bd293

SHA512
8abff473f2fc2180bec253c0deddc65f8dc3a97f7a0c91890ea4b372a14198f4ae66cec7201ad35fa79a4953a9ac6447a92d33c01dd61ad4a8e7f784ee085e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

Filesize
1KB

MD5
fb03ea99c80884fc0bfdb084ad6d9b15

SHA1
f4e9b6cc70de0ae5095973b16fdcd192ef792e9b

SHA256
5756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b

SHA512
0d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

Filesize
607B

MD5
24e6129c8822a48ddec28556a3e2df72

SHA1
5c06510570061f64bbdfccd1c7a7934319e76abd

SHA256
bc8e222cccb089c571b92449f94aea3432450ab562185f82705c1ffc2bccaae5

SHA512
4ffbd31e05f30945f61b45eb83de254ef804ca38112e815c0ab981fe6b84648e15ffd5e4dcd035f6b899891fa4662ecc19f8425a0d0fe956d161c8d163bfdbf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~F5F3.tmp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Installer\MSIF5BB.tmp

Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe

Filesize
56KB

MD5
fcc1dd4e146e391ef903a92fa76c9744

SHA1
23a4b7e248063314b103d61651806af1b2b021d7

SHA256
0e135bfc916702467ce03d43ae9309ff1469d7497bc89c3782057eb9ea867b67

SHA512
99f70ff03760fb481851c1278bc0306367c616cbc74d7cb44e81e1215e9f667066e02d60d63af7faf102093afb831eb0d937016487e59ee586a8212e676f6d9a

Download Submit
memory/684-320-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/848-275-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/864-324-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2020-276-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2232-322-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2664-325-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2664-347-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2664-340-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2664-332-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2664-328-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2704-284-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2756-283-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2828-323-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2828-348-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2828-359-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2828-366-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2968-187-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/2968-190-0x0000000000830000-0x0000000000899000-memory.dmp

Filesize
420KB

Download
memory/2968-194-0x0000000002B10000-0x0000000002BCB000-memory.dmp

Filesize
748KB

Download
memory/2968-198-0x0000000002B10000-0x0000000002CB0000-memory.dmp

Filesize
1.6MB

Download
memory/3012-319-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download