rms | 86c220d1b73c3ed1d84330e4d34f8ddb993177da3d7e33b5de8b24a458ac7ab9

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
Size

4.9MB
MD5

e09ce4c6815db9a8954928be18b9e3ad
SHA1

2c82f757cf8fc537b622ae93b9bdb9cc6eebd5ef
SHA256

86c220d1b73c3ed1d84330e4d34f8ddb993177da3d7e33b5de8b24a458ac7ab9
SHA512

adf8296af4744b594afe5fc701b501c80886e35ad6c84a54f1f7836073b087e73b36568bac662091c1124c7d6915a1b2196c9387c02521319a1eef0dddbffd70
SSDEEP

98304:A+PzP5iw0yhm0J5t8s6kheKqno3KzKWNXblVE3MlYJ4DcLIQeXRxk5oi:AQL5F0mm0nus/sKGoaOWNXbEpJ4I6k5T

Score

10^/10

rms discovery evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2692 attrib.exe

pid	process
2692	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe

Executes dropped EXE 10 IoCs

Processes:

rfusclient.exerutserv.exerfusclient.exerutserv.exerfusclient.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
3168	rfusclient.exe
1392	rutserv.exe
2352	rfusclient.exe
4052	rutserv.exe
4840	rfusclient.exe
2164	rutserv.exe
4768	rutserv.exe
400	rfusclient.exe
3752	rfusclient.exe
2236	rfusclient.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid	process
512	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
216	MsiExec.exe
512	MsiExec.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

14 1612 msiexec.exe
16 1612 msiexec.exe

flow	pid	process
14	1612	msiexec.exe
16	1612	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description ioc process

File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe
File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe

description	ioc	process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\gdiplus.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\e579464.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BF3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D7A.tmp	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\e579460.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579460.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{11A90858-40BB-4858-A2DA-CA6495B5E907}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA491.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

chcp.commsiexec.exerutserv.exerutserv.exereg.exerfusclient.exerfusclient.exerfusclient.exerfusclient.exerfusclient.exereg.exerutserv.exemsiexec.exePING.EXEMsiExec.exeattrib.exerfusclient.exee09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.execmd.exemsiexec.exeMsiExec.exerutserv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3176 PING.EXE

pid	process
3176	PING.EXE

Modifies data under HKEY_USERS 18 IoCs

Processes:

rfusclient.exerfusclient.exemsiexec.exerfusclient.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CLSID\ = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Property Page"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID\ = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Version = "83951616"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8decoder.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "Webm.VP8Decoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisEncoder.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FriendlyName = "Xiph.Org Vorbis Decoder"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FilterData = 02000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000080000000900000003174793300000000a0000000b00000003274793300000000a0000000c00000003170693308000000000000000100000000000000000000003074793300000000a0000000d0000000131789604fc26747b6c96ca05b3338fc8eeb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a0bd12f8d41586b4a8905588fec1aded90100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CurVer\ = "Webm.VP8Decoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F4-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000200002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b715650383000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F1-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\ = "Xiph.Org Vorbis Decoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\PackageName = "rms.server5.1rc1ru.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\AdvertiseFlags = "388"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3176 PING.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exerutserv.exerfusclient.exe

pid process

1612 msiexec.exe
1612 msiexec.exe
4768 rutserv.exe
4768 rutserv.exe
4768 rutserv.exe
4768 rutserv.exe
400 rfusclient.exe
400 rfusclient.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

2236 rfusclient.exe

pid	process
3176	PING.EXE

pid	process
1612	msiexec.exe
1612	msiexec.exe
4768	rutserv.exe
4768	rutserv.exe
4768	rutserv.exe
4768	rutserv.exe
400	rfusclient.exe
400	rfusclient.exe

pid	process
2236	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3680	msiexec.exe
Token: SeSecurityPrivilege	1612	msiexec.exe
Token: SeCreateTokenPrivilege	3680	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3680	msiexec.exe
Token: SeLockMemoryPrivilege	3680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3680	msiexec.exe
Token: SeMachineAccountPrivilege	3680	msiexec.exe
Token: SeTcbPrivilege	3680	msiexec.exe
Token: SeSecurityPrivilege	3680	msiexec.exe
Token: SeTakeOwnershipPrivilege	3680	msiexec.exe
Token: SeLoadDriverPrivilege	3680	msiexec.exe
Token: SeSystemProfilePrivilege	3680	msiexec.exe
Token: SeSystemtimePrivilege	3680	msiexec.exe
Token: SeProfSingleProcessPrivilege	3680	msiexec.exe
Token: SeIncBasePriorityPrivilege	3680	msiexec.exe
Token: SeCreatePagefilePrivilege	3680	msiexec.exe
Token: SeCreatePermanentPrivilege	3680	msiexec.exe
Token: SeBackupPrivilege	3680	msiexec.exe
Token: SeRestorePrivilege	3680	msiexec.exe
Token: SeShutdownPrivilege	3680	msiexec.exe
Token: SeDebugPrivilege	3680	msiexec.exe
Token: SeAuditPrivilege	3680	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3680	msiexec.exe
Token: SeChangeNotifyPrivilege	3680	msiexec.exe
Token: SeRemoteShutdownPrivilege	3680	msiexec.exe
Token: SeUndockPrivilege	3680	msiexec.exe
Token: SeSyncAgentPrivilege	3680	msiexec.exe
Token: SeEnableDelegationPrivilege	3680	msiexec.exe
Token: SeManageVolumePrivilege	3680	msiexec.exe
Token: SeImpersonatePrivilege	3680	msiexec.exe
Token: SeCreateGlobalPrivilege	3680	msiexec.exe
Token: SeShutdownPrivilege	2600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2600	msiexec.exe
Token: SeCreateTokenPrivilege	2600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2600	msiexec.exe
Token: SeLockMemoryPrivilege	2600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2600	msiexec.exe
Token: SeMachineAccountPrivilege	2600	msiexec.exe
Token: SeTcbPrivilege	2600	msiexec.exe
Token: SeSecurityPrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeLoadDriverPrivilege	2600	msiexec.exe
Token: SeSystemProfilePrivilege	2600	msiexec.exe
Token: SeSystemtimePrivilege	2600	msiexec.exe
Token: SeProfSingleProcessPrivilege	2600	msiexec.exe
Token: SeIncBasePriorityPrivilege	2600	msiexec.exe
Token: SeCreatePagefilePrivilege	2600	msiexec.exe
Token: SeCreatePermanentPrivilege	2600	msiexec.exe
Token: SeBackupPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeShutdownPrivilege	2600	msiexec.exe
Token: SeDebugPrivilege	2600	msiexec.exe
Token: SeAuditPrivilege	2600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2600	msiexec.exe
Token: SeChangeNotifyPrivilege	2600	msiexec.exe
Token: SeRemoteShutdownPrivilege	2600	msiexec.exe
Token: SeUndockPrivilege	2600	msiexec.exe
Token: SeSyncAgentPrivilege	2600	msiexec.exe
Token: SeEnableDelegationPrivilege	2600	msiexec.exe
Token: SeManageVolumePrivilege	2600	msiexec.exe
Token: SeImpersonatePrivilege	2600	msiexec.exe
Token: SeCreateGlobalPrivilege	2600	msiexec.exe
Token: SeShutdownPrivilege	3368	msiexec.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.execmd.exemsiexec.exerfusclient.exerfusclient.exerfusclient.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 3496 wrote to memory of 4524	3496	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	cmd.exe
PID 3496 wrote to memory of 4524	3496	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	cmd.exe
PID 3496 wrote to memory of 4524	3496	e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe	cmd.exe
PID 4524 wrote to memory of 1236	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 1236	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 1236	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 3680	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 3680	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 3680	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 2600	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 2600	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 2600	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 3176	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 3176	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 3176	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 3368	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 3368	4524	cmd.exe	msiexec.exe
PID 4524 wrote to memory of 3368	4524	cmd.exe	msiexec.exe
PID 1612 wrote to memory of 512	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 512	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 512	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 216	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 216	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 216	1612	msiexec.exe	MsiExec.exe
PID 1612 wrote to memory of 3168	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 3168	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 3168	1612	msiexec.exe	rfusclient.exe
PID 3168 wrote to memory of 1392	3168	rfusclient.exe	rutserv.exe
PID 3168 wrote to memory of 1392	3168	rfusclient.exe	rutserv.exe
PID 3168 wrote to memory of 1392	3168	rfusclient.exe	rutserv.exe
PID 1612 wrote to memory of 2352	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 2352	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 2352	1612	msiexec.exe	rfusclient.exe
PID 2352 wrote to memory of 4052	2352	rfusclient.exe	rutserv.exe
PID 2352 wrote to memory of 4052	2352	rfusclient.exe	rutserv.exe
PID 2352 wrote to memory of 4052	2352	rfusclient.exe	rutserv.exe
PID 1612 wrote to memory of 4840	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 4840	1612	msiexec.exe	rfusclient.exe
PID 1612 wrote to memory of 4840	1612	msiexec.exe	rfusclient.exe
PID 4524 wrote to memory of 2692	4524	cmd.exe	attrib.exe
PID 4524 wrote to memory of 2692	4524	cmd.exe	attrib.exe
PID 4524 wrote to memory of 2692	4524	cmd.exe	attrib.exe
PID 4840 wrote to memory of 2164	4840	rfusclient.exe	rutserv.exe
PID 4840 wrote to memory of 2164	4840	rfusclient.exe	rutserv.exe
PID 4840 wrote to memory of 2164	4840	rfusclient.exe	rutserv.exe
PID 4524 wrote to memory of 1928	4524	cmd.exe	reg.exe
PID 4524 wrote to memory of 1928	4524	cmd.exe	reg.exe
PID 4524 wrote to memory of 1928	4524	cmd.exe	reg.exe
PID 4524 wrote to memory of 852	4524	cmd.exe	reg.exe
PID 4524 wrote to memory of 852	4524	cmd.exe	reg.exe
PID 4524 wrote to memory of 852	4524	cmd.exe	reg.exe
PID 4768 wrote to memory of 400	4768	rutserv.exe	rfusclient.exe
PID 4768 wrote to memory of 400	4768	rutserv.exe	rfusclient.exe
PID 4768 wrote to memory of 400	4768	rutserv.exe	rfusclient.exe
PID 4768 wrote to memory of 3752	4768	rutserv.exe	rfusclient.exe
PID 4768 wrote to memory of 3752	4768	rutserv.exe	rfusclient.exe
PID 4768 wrote to memory of 3752	4768	rutserv.exe	rfusclient.exe
PID 400 wrote to memory of 2236	400	rfusclient.exe	rfusclient.exe
PID 400 wrote to memory of 2236	400	rfusclient.exe	rfusclient.exe
PID 400 wrote to memory of 2236	400	rfusclient.exe	rfusclient.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2692 attrib.exe

pid	process
2692	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e09ce4c6815db9a8954928be18b9e3ad_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3176
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "rms.server5.1rc1ru.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H +r "C:\Program Files\Remote Manipulator System - Server"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2692
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Un install\{11A90858-40BB-4858-A2DA-CA6495B5E907}" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\In staller\UserData\S-1-5-18\Products\85809A11BB0485842AADAC46595B9E70\Insta llProperties" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D97BB8EDEF9D40E5BC7119995642EB81
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E7CC90C95528772128079CAEA0EA00DF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:216
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1392
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4052
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2164

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:2236
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579463.rbs

Filesize
14KB

MD5
8de7658cf75e3e3baccbcee7d2f844a4

SHA1
94748e85c02e382ec9f6894d8e9af8d272ac748e

SHA256
6917608f05f776ac6863d46079573e038dd0d40124dc188e67622cf56f0e50a7

SHA512
f3aeb838e7cc52be9f631d2bbb90d7812b544dda764b6158ecd017648e45af930f3faa184c1002c32ed326ce536e7fbe337ccc15237d92bc3f2a23c4a3393177

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\English.lg

Filesize
37KB

MD5
e1ef3648745ef44d1918a88e37474ef5

SHA1
a39e15b6987b91774cde383f1696fd992483d27d

SHA256
ade7b68cc10a2c95a94972651cb19179cbb53083d335056cb729401c977627fe

SHA512
cf85d807d9e4b279639e63b66b931724ec3bd09339543d9d9489fcc22bba365df4c7fcdd5adae84256de4050bc6d0e0a05717e55bd5c1691d62ef486a9dd8210

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll

Filesize
198KB

MD5
2d62a5dc205c5f211d9d0c9f5c8251dc

SHA1
a9370a99096ad7352e473571081709ea524bc35c

SHA256
a520c69d34f1ea2a26d4ea00e52352c0be22f8b597c8bf1ba5f83c59cfd1a667

SHA512
8a77c0c4190525f9f8a910b51bef096661ac95d8d2bdc407df690c0769fa9ef3f7f7ed4b188d64874a3a27849a2b5c6df838a58319e506de2185407bacf098b9

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll

Filesize
144KB

MD5
5587454f771e9eeee809ec849b598118

SHA1
a8a74bbfa793035b71af4299acc2db490497e944

SHA256
854a0cb21291b21ef793dcb48c2cd00d7504052b0370062e30bea2095722fabd

SHA512
49f9aa16f9b244f28f3a8dd36d4fa8faf299dadba39df7abf3c223d928c355b439a2007a0fa8421417d3cd5b93c9bd2232e5bc8177d5b9e726414531ff3bf4cd

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll

Filesize
357KB

MD5
0455ff0bd915234eb77ebf8bcf14f13d

SHA1
5dfac2f246717e1ecf4c491e79ce32bb26a8172f

SHA256
eb3c0aef125653db6cdc109e9345921b05a8fcec19be927659af02ee0b0b802f

SHA512
889f655d789d32fbd712b119f2db902949189b1bb0aede08d90c58c5fc8e4d4512ade8aecf2e46434175e00a5fd0ce8c083337f16b9ac35393d4c3a23c70622c

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg

Filesize
40KB

MD5
e338b26aeea96f125b008f3ad4763940

SHA1
f661c0060159a941d79e151250f601cafd838f6f

SHA256
61ed483d8e986b43b07df5af969ce103b35b5d55d7c0acd53299a498b01532e9

SHA512
33d521c5dfecbc805e1aed6745ced0209947ec80bc4369369ead9538f82b654a132db213b881b6dd9e33caa9579f1347be1c43431bc605199d01d7b367cf2ab4

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe

Filesize
3.7MB

MD5
169c64af6a6fad5e03c26b3d6f7f53db

SHA1
495caf5425db10102d6cfc71887db93554539f90

SHA256
c0337d4d5897af91947f012d516b298381748a98da8f15e510b635a2c58287ae

SHA512
314ac5a1bfd94db0ef1f4b1e1ed9bce4ee04b71b9d9499dd7a170d918cf298dc9b87016f8254622fb2ad19a31cfb5ba57920d4d552ec7f030e480dbd102819c1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe

Filesize
4.5MB

MD5
d58e55baf0a9a7e045ff2a029c17383e

SHA1
5e2e676fda575fa1a95fe139d7b8b798f07f7bef

SHA256
716fe90b6df477f134b4733df4548202981c9b4ba23439facb3646199f8b8cfe

SHA512
f4d694fbaa525ee09b8123370982b0680cc269d7a05dc7e9b0a887e49ee101f221c6bdfe37201a2448b883a0b8d1c02092220c7ee502ec7b5f05d856378cde8d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
567B

MD5
45b5b5c39d6e6cd939fec6b3044528b7

SHA1
4758708e1b3bf4cbf58b5485c84f8f2b410d8ef3

SHA256
8a618ba16da60ded8e78d9cc8674b6e304187ec2b718ba7e28d5d391b1e8dd39

SHA512
57fa1dd5c79a66a121342953ad30418fed3c4b99e2174c8f77d4a442db33906a26f017060c1179109a6911767e8de996b9c612e981319595fdba5498e18db2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.server5.1rc1ru.msi

Filesize
5.4MB

MD5
6abc982f20e97d6631160b144562d575

SHA1
edd8d108887c45547a9b032512130636843168fa

SHA256
6553c5f533f519b6542a7e0b0899ade8b8c9fa8263c72adc6fa45a8814649fa4

SHA512
e8560b0afa71a8cc91a4e03dc7e36a22a1af8578536e53a6f8f24479b8fb387fd0f893b400adc762b0b59a5e1b35cb1dfbd286ed5a7d24064c6fd26e8c7b5b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
136913907379112cdcc322a7758be9b8

SHA1
6b92e828d4c8bf822b5f74696e7fff99cd23a544

SHA256
aacf1b3f1e3e54800fb669d1df7884b2f6a8cf71054587a2b35afdad5184d54c

SHA512
fcb6c48a0d1a6eff94ae07079bf0ed56330644aa0df45330ff8eb4af78844b48a716efa67ccdcb560528af185991a0e722a2a1533db68c8861d48209bca64559

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
a326927fc5c5b40517642a5c1e1fcc08

SHA1
7c44080ecf01293443a95a93aad965aa59698369

SHA256
3e7982c5eb7c0ce065f4b66c622a73e5d687ec34ba5633fabf593cdc563bd293

SHA512
8abff473f2fc2180bec253c0deddc65f8dc3a97f7a0c91890ea4b372a14198f4ae66cec7201ad35fa79a4953a9ac6447a92d33c01dd61ad4a8e7f784ee085e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
fb03ea99c80884fc0bfdb084ad6d9b15

SHA1
f4e9b6cc70de0ae5095973b16fdcd192ef792e9b

SHA256
5756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b

SHA512
0d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
338B

MD5
c6a8f10584d19fc644c0d1d596936000

SHA1
299d7e483a003a2e7387f15793474da428a2abb0

SHA256
ebd31d2b6a29dfd4cc4127cb4b1b2c31ac91bcc8b336c060de6ad57e0ee81d8e

SHA512
f5c0ad38fdab5cb896fae3c5df321d9a262af9e1e47aa5346f749bed044d3d0fdd6a5a125a024cff9eae1de1f77061e0250a4bcc43fa56f2495eb35df8c630e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
3191b3011a4e7d1319d41945c5cc770b

SHA1
e985a16536f205b5c58a50310a3860df007ac164

SHA256
4c1938092f84eb5f35b9ca3060c3faf4eef047f852d903fcd479ded13ed56e2d

SHA512
7763b1ccfcbcd4faeb2537a161b97844aae417eac46b7ad7fe4018dd109a9c52964b1e9a8b5a8723cb5feeb0588169a49419ab77dc6de125a40b04afebce21cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
6177d1d6c3c98c6a693b37860f30ea6b

SHA1
82c5f128489a1a194aaa6db641a2e8cf4e560f5b

SHA256
0903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76

SHA512
fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9C4F.tmp

Filesize
1KB

MD5
c54e13e431501d359a7c98938a867743

SHA1
234882085bbd3ce45cd17632d914cd9c91d6968f

SHA256
a774631379492e69d9ba3348ac8dcfdc31663427a3d5525c2f0330b182d75a0d

SHA512
63a6b98a2ca7804863370ce61cdaf8c125682140d8b22e709d8d5929d5aa9192d1ab04a3fa648b604185afe40324cfb5e82bee39382bea625625566da98cb3f7

Download Submit
C:\Windows\Installer\MSI9BF3.tmp

Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe

Filesize
56KB

MD5
fcc1dd4e146e391ef903a92fa76c9744

SHA1
23a4b7e248063314b103d61651806af1b2b021d7

SHA256
0e135bfc916702467ce03d43ae9309ff1469d7497bc89c3782057eb9ea867b67

SHA512
99f70ff03760fb481851c1278bc0306367c616cbc74d7cb44e81e1215e9f667066e02d60d63af7faf102093afb831eb0d937016487e59ee586a8212e676f6d9a

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/216-166-0x0000000002C00000-0x0000000002CBB000-memory.dmp

Filesize
748KB

Download
memory/216-156-0x0000000002B00000-0x0000000002B3D000-memory.dmp

Filesize
244KB

Download
memory/216-161-0x0000000002C00000-0x0000000002C69000-memory.dmp

Filesize
420KB

Download
memory/216-171-0x0000000002C00000-0x0000000002DA0000-memory.dmp

Filesize
1.6MB

Download
memory/400-282-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/1392-242-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2164-277-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2236-280-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/2352-247-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/3168-243-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/3752-283-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/3752-286-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/3752-290-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/3752-297-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download
memory/4052-246-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4768-281-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4768-288-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4768-291-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4768-317-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4768-324-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/4840-278-0x0000000000400000-0x000000000083C000-memory.dmp

Filesize
4.2MB

Download