neshta | 713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
Size

7.1MB
MD5

d3e1dd11e0f01bbbe93f9ac0406c54c0
SHA1

2c7adcd44d5ed660cd9cdb97426a4c91eff00368
SHA256

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8
SHA512

7cff26517356dcf48e3da0ee7a69f0023c1e72a2cb07e4a81e0bbed9200ef808245ae68ad6db42f4613eb6e08ca730b7a846dd24dfc7f4d92330d238b8aacb5f
SSDEEP

196608:Eb2IrnugKVAuAwVbdiU9mRwvuoklW0YrUvw:BgKVAuAIluDLlDYYI

Score

10^/10

neshta rms discovery persistence rat spyware stealer trojan

Malware Config

Signatures

Detect Neshta payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	family_neshta
behavioral2/memory/1104-263-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1104-270-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1104-275-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Desktop.exeRMS.sfx.exeRMS.exehider.exe713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Desktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	RMS.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	RMS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	hider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe

Executes dropped EXE 12 IoCs

Processes:

Desktop.exeRMS.sfx.exeRMS.exehider.exehider.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
4124	Desktop.exe
2560	RMS.sfx.exe
3600	RMS.exe
1104	hider.exe
3620	hider.exe
3468	rutserv.exe
1060	rutserv.exe
2300	rutserv.exe
344	rutserv.exe
956	rfusclient.exe
2788	rfusclient.exe
4828	rfusclient.exe

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

1428 MsiExec.exe
Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1546.001

Processes:

hider.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" hider.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

25 1312 msiexec.exe
28 1312 msiexec.exe

pid	process
1428	MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	hider.exe

flow	pid	process
25	1312	msiexec.exe
28	1312	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe	autoit_exe

Drops file in Program Files directory 64 IoCs

Processes:

hider.exemsiexec.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng	msiexec.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	hider.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	hider.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	hider.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	hider.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	hider.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	hider.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	hider.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd	msiexec.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	hider.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	hider.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	hider.exe

Drops file in Windows directory 20 IoCs

Processes:

msiexec.exehider.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC6B.tmp	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b3bf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\svchost.com	hider.exe
File created	C:\Windows\Installer\e57b3bf.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57b3c3.msi	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB70.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{052DF202-F103-46C9-824D-28F4BB04DAB3}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regedit.exehider.exerutserv.exerfusclient.exe713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exemsiexec.exechcp.comhider.exerutserv.exerutserv.execmd.exeRMS.sfx.exerfusclient.exeRMS.execmd.exePING.EXEmsiexec.exeMsiExec.exerutserv.exerfusclient.exeDesktop.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hider.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hider.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RMS.sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RMS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Desktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

1532 PING.EXE

pid	process
1532	PING.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 45 IoCs

Processes:

msiexec.exeregedit.exehider.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Clients = 3a0000000000	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\LastUsedSource = "n;1;C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Language = "1049"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AdvertiseFlags = "388"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\DeploymentFlags = "3"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductName	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\PackageName = "host.msi"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\202FD250301F9C6428D4824FBB40AD3B\RMS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Version = "100603060"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Assignment = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\DiskPrompt = "[1]"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Language = "1049"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\ProductIcon = "C:\\Windows\\Installer\\{052DF202-F103-46C9-824D-28F4BB04DAB3}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AuthorizedLUAApp = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\PackageCode = "9F93235A3BF2E414AB9ABB0B9ED903C5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Version = "100925440"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	hider.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\PackageCode = "CA621BAB2625C4F47B0824566FC192D8"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\InstanceType = "0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\1 = "DISK1;1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net\1 = "C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductIcon = "C:\\Windows\\Installer\\{C2AD926E-45DC-4C5F-88A0-63AEE6A3262A}\\ARPPRODUCTICON.exe"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\PackageName = "host.msi"	msiexec.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2944 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1532 PING.EXE

pid	process
2944	regedit.exe

pid	process
1532	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	process
1312	msiexec.exe
1312	msiexec.exe
3468	rutserv.exe
3468	rutserv.exe
3468	rutserv.exe
3468	rutserv.exe
3468	rutserv.exe
3468	rutserv.exe
1060	rutserv.exe
1060	rutserv.exe
2300	rutserv.exe
2300	rutserv.exe
344	rutserv.exe
344	rutserv.exe
344	rutserv.exe
344	rutserv.exe
344	rutserv.exe
344	rutserv.exe
956	rfusclient.exe
956	rfusclient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hider.exe

pid process

3620 hider.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

4828 rfusclient.exe

pid	process
3620	hider.exe

pid	process
4828	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	1312	msiexec.exe
Token: SeCreateTokenPrivilege	1244	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1244	msiexec.exe
Token: SeLockMemoryPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeMachineAccountPrivilege	1244	msiexec.exe
Token: SeTcbPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeLoadDriverPrivilege	1244	msiexec.exe
Token: SeSystemProfilePrivilege	1244	msiexec.exe
Token: SeSystemtimePrivilege	1244	msiexec.exe
Token: SeProfSingleProcessPrivilege	1244	msiexec.exe
Token: SeIncBasePriorityPrivilege	1244	msiexec.exe
Token: SeCreatePagefilePrivilege	1244	msiexec.exe
Token: SeCreatePermanentPrivilege	1244	msiexec.exe
Token: SeBackupPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeDebugPrivilege	1244	msiexec.exe
Token: SeAuditPrivilege	1244	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1244	msiexec.exe
Token: SeChangeNotifyPrivilege	1244	msiexec.exe
Token: SeRemoteShutdownPrivilege	1244	msiexec.exe
Token: SeUndockPrivilege	1244	msiexec.exe
Token: SeSyncAgentPrivilege	1244	msiexec.exe
Token: SeEnableDelegationPrivilege	1244	msiexec.exe
Token: SeManageVolumePrivilege	1244	msiexec.exe
Token: SeImpersonatePrivilege	1244	msiexec.exe
Token: SeCreateGlobalPrivilege	1244	msiexec.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeCreateTokenPrivilege	4776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4776	msiexec.exe
Token: SeLockMemoryPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeMachineAccountPrivilege	4776	msiexec.exe
Token: SeTcbPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	4776	msiexec.exe
Token: SeTakeOwnershipPrivilege	4776	msiexec.exe
Token: SeLoadDriverPrivilege	4776	msiexec.exe
Token: SeSystemProfilePrivilege	4776	msiexec.exe
Token: SeSystemtimePrivilege	4776	msiexec.exe
Token: SeProfSingleProcessPrivilege	4776	msiexec.exe
Token: SeIncBasePriorityPrivilege	4776	msiexec.exe
Token: SeCreatePagefilePrivilege	4776	msiexec.exe
Token: SeCreatePermanentPrivilege	4776	msiexec.exe
Token: SeBackupPrivilege	4776	msiexec.exe
Token: SeRestorePrivilege	4776	msiexec.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeDebugPrivilege	4776	msiexec.exe
Token: SeAuditPrivilege	4776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4776	msiexec.exe
Token: SeChangeNotifyPrivilege	4776	msiexec.exe
Token: SeRemoteShutdownPrivilege	4776	msiexec.exe
Token: SeUndockPrivilege	4776	msiexec.exe
Token: SeSyncAgentPrivilege	4776	msiexec.exe
Token: SeEnableDelegationPrivilege	4776	msiexec.exe
Token: SeManageVolumePrivilege	4776	msiexec.exe
Token: SeImpersonatePrivilege	4776	msiexec.exe
Token: SeCreateGlobalPrivilege	4776	msiexec.exe
Token: SeShutdownPrivilege	3512	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exemsiexec.exerfusclient.exe

pid process

1244 msiexec.exe
1244 msiexec.exe
4776 msiexec.exe
4776 msiexec.exe
2788 rfusclient.exe
2788 rfusclient.exe
2788 rfusclient.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

rfusclient.exe

pid process

2788 rfusclient.exe
2788 rfusclient.exe
2788 rfusclient.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid process

3468 rutserv.exe
1060 rutserv.exe
2300 rutserv.exe
344 rutserv.exe

pid	process
1244	msiexec.exe
1244	msiexec.exe
4776	msiexec.exe
4776	msiexec.exe
2788	rfusclient.exe
2788	rfusclient.exe
2788	rfusclient.exe

pid	process
2788	rfusclient.exe
2788	rfusclient.exe
2788	rfusclient.exe

pid	process
3468	rutserv.exe
1060	rutserv.exe
2300	rutserv.exe
344	rutserv.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exeDesktop.execmd.exeRMS.sfx.exeRMS.execmd.exehider.exemsiexec.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 4880 wrote to memory of 4124	4880	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 4880 wrote to memory of 4124	4880	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 4880 wrote to memory of 4124	4880	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 4124 wrote to memory of 1736	4124	Desktop.exe	cmd.exe
PID 4124 wrote to memory of 1736	4124	Desktop.exe	cmd.exe
PID 4124 wrote to memory of 1736	4124	Desktop.exe	cmd.exe
PID 1736 wrote to memory of 2560	1736	cmd.exe	RMS.sfx.exe
PID 1736 wrote to memory of 2560	1736	cmd.exe	RMS.sfx.exe
PID 1736 wrote to memory of 2560	1736	cmd.exe	RMS.sfx.exe
PID 2560 wrote to memory of 3600	2560	RMS.sfx.exe	RMS.exe
PID 2560 wrote to memory of 3600	2560	RMS.sfx.exe	RMS.exe
PID 2560 wrote to memory of 3600	2560	RMS.sfx.exe	RMS.exe
PID 3600 wrote to memory of 2592	3600	RMS.exe	cmd.exe
PID 3600 wrote to memory of 2592	3600	RMS.exe	cmd.exe
PID 3600 wrote to memory of 2592	3600	RMS.exe	cmd.exe
PID 2592 wrote to memory of 4836	2592	cmd.exe	chcp.com
PID 2592 wrote to memory of 4836	2592	cmd.exe	chcp.com
PID 2592 wrote to memory of 4836	2592	cmd.exe	chcp.com
PID 2592 wrote to memory of 1244	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 1244	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 1244	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 4776	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 4776	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 4776	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 1104	2592	cmd.exe	hider.exe
PID 2592 wrote to memory of 1104	2592	cmd.exe	hider.exe
PID 2592 wrote to memory of 1104	2592	cmd.exe	hider.exe
PID 2592 wrote to memory of 2944	2592	cmd.exe	regedit.exe
PID 2592 wrote to memory of 2944	2592	cmd.exe	regedit.exe
PID 2592 wrote to memory of 2944	2592	cmd.exe	regedit.exe
PID 2592 wrote to memory of 1532	2592	cmd.exe	PING.EXE
PID 2592 wrote to memory of 1532	2592	cmd.exe	PING.EXE
PID 2592 wrote to memory of 1532	2592	cmd.exe	PING.EXE
PID 1104 wrote to memory of 3620	1104	hider.exe	hider.exe
PID 1104 wrote to memory of 3620	1104	hider.exe	hider.exe
PID 1104 wrote to memory of 3620	1104	hider.exe	hider.exe
PID 2592 wrote to memory of 3512	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 3512	2592	cmd.exe	msiexec.exe
PID 2592 wrote to memory of 3512	2592	cmd.exe	msiexec.exe
PID 1312 wrote to memory of 1428	1312	msiexec.exe	MsiExec.exe
PID 1312 wrote to memory of 1428	1312	msiexec.exe	MsiExec.exe
PID 1312 wrote to memory of 1428	1312	msiexec.exe	MsiExec.exe
PID 1312 wrote to memory of 3468	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 3468	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 3468	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 1060	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 1060	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 1060	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 2300	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 2300	1312	msiexec.exe	rutserv.exe
PID 1312 wrote to memory of 2300	1312	msiexec.exe	rutserv.exe
PID 344 wrote to memory of 956	344	rutserv.exe	rfusclient.exe
PID 344 wrote to memory of 956	344	rutserv.exe	rfusclient.exe
PID 344 wrote to memory of 956	344	rutserv.exe	rfusclient.exe
PID 344 wrote to memory of 2788	344	rutserv.exe	rfusclient.exe
PID 344 wrote to memory of 2788	344	rutserv.exe	rfusclient.exe
PID 344 wrote to memory of 2788	344	rutserv.exe	rfusclient.exe
PID 956 wrote to memory of 4828	956	rfusclient.exe	rfusclient.exe
PID 956 wrote to memory of 4828	956	rfusclient.exe	rfusclient.exe
PID 956 wrote to memory of 4828	956	rfusclient.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
"C:\Users\Admin\AppData\Local\Temp\713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Desktop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\RMS.sfx.exe
      RMS.sfx.exe -p112233 -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\RMS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RMS.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1244
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {052DF202-F103-46C9-824D-28F4BB04DAB3} /passive REBOOT=ReallySuppress
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe
        
        hider.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies system executable filetype association
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3620
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regedit.reg
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Runs .reg file with regedit
        
        PID:2944
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1532
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /I "host.msi" /qn
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E42C0DE4968117C47716B535D274913
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1428
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3468
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1060
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2300

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:344
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:4828
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b3c2.rbs

Filesize
20KB

MD5
577978e32af1119f377c8a40d7467dbe

SHA1
830187f115afcd4624841ce3d1926968eaeeee2f

SHA256
3f1b34290a3039f6b7e67bfeb9a434e2503c7828d9aa19c3cd6bc0aebef05af4

SHA512
41dcd0269b9a77cdd3f526cecc9528d6951423b77f90cfd56ade424f3749dc18a4d4590f59b26ca17fd439824748eb8dc3e4153a4126b99ff39d81f33855c574

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
39c8a4c2c3984b64b701b85cb724533b

SHA1
c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

SHA256
888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

SHA512
f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
43KB

MD5
3e9f90664b9634099e9727d179bc11b7

SHA1
de77b77f74d84a5ffeeda14f036a3917ae1195a3

SHA256
490c7d1cb173a86b2039406541ea51c1d375f49547ad2a06de127481c2ac7ecf

SHA512
d2159afbffd409d3a595cd8b1256366fedaf5fa49badd4534dc8de6e61a6658c87300297b24d4ca9c498f1c14c053e1caf222b8c5867547b4efe7bab2efa7129

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
145KB

MD5
a2c0939df5f3c48227dd31c3f95b6de1

SHA1
99fa87b995fc78c3edacb231a31cce33a337f371

SHA256
fe7be342564d8ed7fd584f0e47601dd4a3e4aeb3af51fadb49ec70a2b7827e6a

SHA512
c881a40dd857637ae7dae67dec83918fdb39d02eb5bce84c7bc6ff0111ddc57af844f60fe3b259fb903b10609139f22783c746c7610ab552c9ebec584dd6f8b3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
976KB

MD5
ce8162b35f8853fb34ba2ff47b4aac73

SHA1
852d647635f9841671de9b931831e49eade8cada

SHA256
1f4d34244807ca97e13ee49718ab42ebf9673095619fd0dcf1ef7a2cd789008d

SHA512
3600bcc6e7c77841d1356c484a8f46257c0c0c396f3aa5aa78a5509f2847cde5117f047ec8a07374b03abb41e51151c08d45bc1dfde6775e9ae5d13ca5af6fc1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
48KB

MD5
78394a154feb33ccc8906dc5aa8abdfc

SHA1
9b9f3c219ebe07753ba72d0161ab52258a541159

SHA256
77d7745e1f368f009da80def11ff3c38d72265ad258524996bf777b04b9f3c55

SHA512
828cccf1add88cd8a953ea76e4fd4a2728156c01253192ef95efdb92045755935aea0445b158a74d0d42f0e2b7706e637c623441bd5159870793cf360575a946

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
3a0f8eded8325feabe74c0921271c6e6

SHA1
be20ba359e25a02212bf3c05989e30a343b155d1

SHA256
2f26fbc1f0e7747f2356c391860bfb651adfb62c63bca05a41e39f4763b9afe3

SHA512
bc20a4af1d1e7ec95ce47daefb20aa3958b898927efe0caba3ef5298a6b86746a2b8ac5837a8f778b3391208c35fa50fb5d5ccd0649423310897b01bbac16443

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.1MB

MD5
13b2bad4e17ce849587746dc186ebce2

SHA1
2d1c673dbcc75e561a9e35c9994e01395b5025d0

SHA256
5631cffa8b148ffa478f49a178de266508b685fef86c32fb7a899379e732249a

SHA512
a9d3f41534c7126cb08cf840409c5b48b2420f853364e78101a70f71d0c7e5ec0e19d4c61acbea88b723aef810cad0d7ae3e73c986d683e46229f88b7ab653b7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
368KB

MD5
eae4541acd1011a52deb706440c47ac1

SHA1
1648c82f20bcc77e099194fbe5f307cd4cdd0b51

SHA256
416c3a671a5e88509b00ac434f0d2002ea03993fa222bb437b0f1f34c93480b1

SHA512
60e023f8db5a524cbfae3137cfd57c9fba654ebf2f693a0181e3282cce5b7381f0f30f3b280d7048443e968f7cabcf9a48432dbaf0f6bf63c1e5ba2d9e7a6159

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
624KB

MD5
b59068db99550dccda9d26cbfdefe50f

SHA1
612b153a0f000ee0114335c9bb2ba668572c172e

SHA256
59192c88831aa9f06cf2a699145a289c8482ad57888de1ca6f031971e54838ef

SHA512
9ed46090aeeecd33216189d759b5db62ade28e8f2efec7999116bcd30b3a003492a9a5f8d8cc2f1d4799b126556fb589436c1a538a70f2803b6539a30cd1783a

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Filesize
236KB

MD5
917ddc7d35424c3ae0d875bb98824a81

SHA1
0f91e4229952ab1f27ac57cd0a09682418569fe7

SHA256
9f2b3d24dea4d90679c1ee5d0c90b45683dde390323ad47ab1e4b7c34b7c62ff

SHA512
4b6c1cbd4b69cf2230c989301db36d06c4e66517e79a16e699b2497c80ca8b315194a38095afadd6373c9e0811d9dbd277a91e4be90bdd70680f8e5f4bf33aaf

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Filesize
324KB

MD5
4dfef8a4490a49790be02abd7483f135

SHA1
68ce62ea1f6bc5f2706fb1b86dd8d88f035625b7

SHA256
4190a7866c28cf4ac40ef2e8f1b31e48e3df79b1497c3a31136774bbd0cf6087

SHA512
3706e36fe6fa2b9a27008ce263fe00ba045151b69de87ec2d9638032336660281c63fcc6efb202b725720e186bfade2ba04722df2e692c0ccfce03b8629002da

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Filesize
1.7MB

MD5
de2a525d42130c9d119ae870da97ec71

SHA1
8d86b03e1c6b34c365c3ab50884e1f4067fe4068

SHA256
b1fa6f9b5c036e44b00550da019ffb7d4d6c7d36d94f1b5af629f35d6c60eeb4

SHA512
aada65b93ea510604df53ac40548c33e5a6348d70b898eeb335839b1dc7c273d01de7c9989dbceb4a5609e1eb6b33cff81a8e71a6f12ae0fa621163c17aad476

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
29B

MD5
8a75801ccaaa5caa9823f1baf2840571

SHA1
5457940aad7af0ea1b88e70bec0621a13ee968b7

SHA256
0cb9043c598db88734389e663457966c383b1c6dcc06306f4250b21ba6bde2b9

SHA512
d811eecf41e022bb1ccca4ffeb51b0a78c50db54d6d861086d6bea052414d81c869ebcc96c1f593a31e4e2b7d4c4e663eae672f87d64b2e6c80a7c1693646aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe

Filesize
839KB

MD5
045fde9f9507c142cd8433e21d778f42

SHA1
231b352e986a1ac71fa08f7b26be785d36424a85

SHA256
b12943cafc7b9a793ccc486049d9eb7be1167494664f01fd715083b8608f16a7

SHA512
8c32a3b015f66027d4cb6b7f0a585eb7bd3a31ea2232fbefa66b2cf2d0a74e889bfdd8f86a30fb14ed82c56eecc12f4bfc58d6ce9816633d7e093cde0f68154d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe

Filesize
880KB

MD5
0c796e388e5bb3517a61bdb0e2a8810e

SHA1
86b2c29152a0038e34053093ebdcc4f251268e9e

SHA256
74edad6c32d5d0cd251d9e5fe630327cf4e692c9ebe436ba281ab8c3b25f53bc

SHA512
614305e9c69e5f6881ebce0b2e95c6f0c236dad88237e7aa0d97b4c46811ade4cec934b0f057d53e2159b14e8d5edbf912436e05b26fdcd876bfabd35fd42390

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi

Filesize
7.0MB

MD5
cbfb4ce0261a2a2aaca840e36f9e729b

SHA1
4ccc8f8b4cd31063afecaaf041b4ed97f0b57dad

SHA256
12df9c6dc2d8e2a23420ebe6b58ebd1db2fb772d880820193cbce85bb934749f

SHA512
9b94f6bb94e4dfeac1e2464b317a2394914eae333e10ce93cc3473467d2a698ad71b90a72e090453631ccd0a3b418e2a50256bd8146b0133be8dbd33a8db6852

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
264B

MD5
435aec1fbfb10c119fa243778142c1dc

SHA1
b3b01913c49920fcbf0dbe23159d75cc6eb058b3

SHA256
307e24d67bdce6b881750c967585ca3c4feeecdcbabfbe32f7fc8e9ee0f3139a

SHA512
e5bc200a50ce9937afb423eaacb87ab212765b7ecc0f1d617787688b6067eefc95e8e8cedeb51a5e7a6cfbf89725bfaf75e7c3ea4d8cd17d5528b3c080c202d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\regedit.reg

Filesize
3KB

MD5
66e2270250f7e8f568c706be75067e4b

SHA1
96b85b7fecfe0aaa4fb3b1329099a733a58529ae

SHA256
ab379c50047643d2e1b062e9a938d8391a78c85055941face68aa810952c6603

SHA512
1019882ae644bbc81fcbcfc6a85bac919be3ada1677349c9e52bf431a6faa10b81b37d20d0bba73843634588452e86efc7199c2efd936d683be7e63f6a211cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Desktop.exe

Filesize
6.8MB

MD5
fc9f1cfbbe0e5a33c365571d27f660c6

SHA1
09dae91cc367c188af28a51843df8ad87fa5a502

SHA256
41a67e8943d68107f79101a91e045ba34a5d8ee653310b4b8753b8a53400bfd6

SHA512
f88b59df41865ca97a66888bb5cda5f930105e9521f086a9173038ee7d921f05e755cbf196c6324667430b706747dd1cd4cf55e5f9c74c8fa059a7f57739898e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS.exe

Filesize
6.6MB

MD5
f74cca6d5ae0e8cfdff100d2cf607eb5

SHA1
18efbce1da063fb90f9af4be9f9f23607feb9d12

SHA256
35165f8a7218eff0c6ad478d92e182e019eed97278a24a33985a1451f0c919ac

SHA512
b20e7d373de3664d94dfa268bcec7dea294c5b4b1fca9570cb9d416ea5f3895c42910ca34bf828655040b78459c7cd460341d4d36021e72ec77a7485250dca68

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS.sfx.exe

Filesize
6.7MB

MD5
af0d19d8035b07f70e70eaed1b03ac03

SHA1
c5be6e7308b81c5058fbe13b8777b4f940d7f57e

SHA256
37eab2baf4069ba154dda245b795d5cabe3fa1a9d26204da0b2e9c01b8486d91

SHA512
0b298dcd045cb51cea16736d8deb6e4c4f7a1aacdb2811a3403e3a40c068f116eede32ac12628d82ff20d1309663342ed1f33f76d9817a0f50046bf35b1de092

Download Submit
C:\Windows\Installer\MSIBB70.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Filesize
96KB

MD5
9e2c097647125ee25068784acb01d7d3

SHA1
1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5

SHA256
b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2

SHA512
e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1

Download Submit
memory/344-277-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-313-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-306-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-302-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-299-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-267-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-292-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-284-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/344-280-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/956-268-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/1060-230-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/1104-275-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1104-270-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1104-263-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2300-256-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2788-279-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2788-273-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2788-286-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2788-269-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2788-294-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/3468-228-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/4828-265-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download