rms | ecca5e5ec8023a414bf77bf0cd489f33540e603184fd20914688a999a08cbab8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe
Size

2.5MB
MD5

cd5c31ede1cbdd9d25065e61a19fa245
SHA1

665573e81301cd999cdfcf62899aa437558eb9d0
SHA256

ecca5e5ec8023a414bf77bf0cd489f33540e603184fd20914688a999a08cbab8
SHA512

b54dd6d0fee7050419d6df7358ea53690bf00e6f4b84579e0bb87b979499b348b1eef22d5e2a7fa5a51d69607201738e42fc16fa27d3f3b19e215bf365d39b86
SSDEEP

49152:5XPRhJBTk1xLWUMu8XQaFjeVPq/AMHNR8JH66thE0fO/2K6juvW:5jJBI2U6XgVPSMJHHthE04uuW

Score

10^/10

rms defense_evasion discovery evasion execution persistence privilege_escalation rat trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Rms family
rms

Indicator Removal: Network Share Connection Removal 1 TTPs 4 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
1072	net1.exe
4180	net.exe
4648	net.exe
3616	net1.exe

Modifies Windows Firewall 2 TTPs 16 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
64	netsh.exe
808	netsh.exe
3704	netsh.exe
4772	netsh.exe
4324	netsh.exe
4164	netsh.exe
2884	netsh.exe
4656	netsh.exe
2732	netsh.exe
3964	netsh.exe
3608	netsh.exe
4716	netsh.exe
4736	netsh.exe
3220	netsh.exe
4328	netsh.exe
2904	netsh.exe

Sets file to hidden 1 TTPs 8 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
228	attrib.exe
2288	attrib.exe
1436	attrib.exe
2292	attrib.exe
4344	attrib.exe
2144	attrib.exe
1800	attrib.exe
4704	attrib.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe

Executes dropped EXE 10 IoCs

pid	Process
2616	setup.exe
1016	setup.exe
2588	rutserv.exe
4440	rutserv.exe
1980	rutserv.exe
1840	rutserv.exe
4572	rutserv.exe
4660	rfusclient.exe
1208	rfusclient.exe
868	rfusclient.exe

Loads dropped DLL 16 IoCs

pid	Process
2588	rutserv.exe
2588	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
1840	rutserv.exe
1840	rutserv.exe
4572	rutserv.exe
4572	rutserv.exe
4660	rfusclient.exe
4660	rfusclient.exe
1208	rfusclient.exe
1208	rfusclient.exe
868	rfusclient.exe
868	rfusclient.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\exe\rutserv.pdb	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4940	sc.exe
4988	sc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 48 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
4884	taskkill.exe
3936	taskkill.exe
2124	taskkill.exe
688	taskkill.exe
4504	taskkill.exe
3000	taskkill.exe
316	taskkill.exe
540	taskkill.exe
1220	taskkill.exe
2376	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	setup.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4848	reg.exe
4796	reg.exe
4356	reg.exe
2060	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2372	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
4572	rutserv.exe
4572	rutserv.exe
4572	rutserv.exe
4572	rutserv.exe
1208	rfusclient.exe
1208	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	1220	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	2588	rutserv.exe
Token: SeDebugPrivilege	1980	rutserv.exe
Token: SeDebugPrivilege	1840	rutserv.exe
Token: SeTakeOwnershipPrivilege	4572	rutserv.exe
Token: SeTcbPrivilege	4572	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2616	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	89
PID 4180 wrote to memory of 2616	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	89
PID 4180 wrote to memory of 2616	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	89
PID 4180 wrote to memory of 1016	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	90
PID 4180 wrote to memory of 1016	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	90
PID 4180 wrote to memory of 1016	4180	cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe	90
PID 2616 wrote to memory of 4124	2616	setup.exe	91
PID 2616 wrote to memory of 4124	2616	setup.exe	91
PID 2616 wrote to memory of 4124	2616	setup.exe	91
PID 1016 wrote to memory of 3140	1016	setup.exe	92
PID 1016 wrote to memory of 3140	1016	setup.exe	92
PID 1016 wrote to memory of 3140	1016	setup.exe	92
PID 3140 wrote to memory of 3976	3140	WScript.exe	93
PID 3140 wrote to memory of 3976	3140	WScript.exe	93
PID 3140 wrote to memory of 3976	3140	WScript.exe	93
PID 4124 wrote to memory of 1152	4124	WScript.exe	94
PID 4124 wrote to memory of 1152	4124	WScript.exe	94
PID 4124 wrote to memory of 1152	4124	WScript.exe	94
PID 1016 wrote to memory of 1784	1016	setup.exe	97
PID 1016 wrote to memory of 1784	1016	setup.exe	97
PID 1016 wrote to memory of 1784	1016	setup.exe	97
PID 1152 wrote to memory of 540	1152	cmd.exe	99
PID 1152 wrote to memory of 540	1152	cmd.exe	99
PID 1152 wrote to memory of 540	1152	cmd.exe	99
PID 3976 wrote to memory of 1220	3976	cmd.exe	100
PID 3976 wrote to memory of 1220	3976	cmd.exe	100
PID 3976 wrote to memory of 1220	3976	cmd.exe	100
PID 1152 wrote to memory of 2124	1152	cmd.exe	101
PID 1152 wrote to memory of 2124	1152	cmd.exe	101
PID 1152 wrote to memory of 2124	1152	cmd.exe	101
PID 3976 wrote to memory of 688	3976	cmd.exe	102
PID 3976 wrote to memory of 688	3976	cmd.exe	102
PID 3976 wrote to memory of 688	3976	cmd.exe	102
PID 1152 wrote to memory of 3724	1152	cmd.exe	103
PID 1152 wrote to memory of 3724	1152	cmd.exe	103
PID 1152 wrote to memory of 3724	1152	cmd.exe	103
PID 3976 wrote to memory of 3220	3976	cmd.exe	156
PID 3976 wrote to memory of 3220	3976	cmd.exe	156
PID 3976 wrote to memory of 3220	3976	cmd.exe	156
PID 1152 wrote to memory of 2144	1152	cmd.exe	105
PID 1152 wrote to memory of 2144	1152	cmd.exe	105
PID 1152 wrote to memory of 2144	1152	cmd.exe	105
PID 3976 wrote to memory of 1800	3976	cmd.exe	106
PID 3976 wrote to memory of 1800	3976	cmd.exe	106
PID 3976 wrote to memory of 1800	3976	cmd.exe	106
PID 1152 wrote to memory of 4344	1152	cmd.exe	107
PID 1152 wrote to memory of 4344	1152	cmd.exe	107
PID 1152 wrote to memory of 4344	1152	cmd.exe	107
PID 1152 wrote to memory of 2292	1152	cmd.exe	108
PID 1152 wrote to memory of 2292	1152	cmd.exe	108
PID 1152 wrote to memory of 2292	1152	cmd.exe	108
PID 1152 wrote to memory of 1436	1152	cmd.exe	109
PID 1152 wrote to memory of 1436	1152	cmd.exe	109
PID 1152 wrote to memory of 1436	1152	cmd.exe	109
PID 1152 wrote to memory of 1700	1152	cmd.exe	110
PID 1152 wrote to memory of 1700	1152	cmd.exe	110
PID 1152 wrote to memory of 1700	1152	cmd.exe	110
PID 1700 wrote to memory of 3164	1700	net.exe	111
PID 1700 wrote to memory of 3164	1700	net.exe	111
PID 1700 wrote to memory of 3164	1700	net.exe	111
PID 1152 wrote to memory of 4504	1152	cmd.exe	112
PID 1152 wrote to memory of 4504	1152	cmd.exe	112
PID 1152 wrote to memory of 4504	1152	cmd.exe	112
PID 1152 wrote to memory of 4884	1152	cmd.exe	113

Views/modifies file attributes 1 TTPs 22 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1964	attrib.exe
2608	attrib.exe
464	attrib.exe
228	attrib.exe
1108	attrib.exe
5096	attrib.exe
2292	attrib.exe
2356	attrib.exe
4544	attrib.exe
2144	attrib.exe
2644	attrib.exe
3212	attrib.exe
3564	attrib.exe
1800	attrib.exe
2288	attrib.exe
4344	attrib.exe
3456	attrib.exe
2656	attrib.exe
2572	attrib.exe
4704	attrib.exe
1312	attrib.exe
1436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cd5c31ede1cbdd9d25065e61a19fa245_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4180
- C:\setup.exe
  "C:\setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
      4⤵
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im RManServer.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\System32\catroot3"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2144
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4344
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2292
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\de.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1436
    - - C:\Windows\SysWOW64\net.exe
        
        net stop rserver3
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        6⤵
        
        PID:3164
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rserver3.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im r_server.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cam_server.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\system32\cam_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2644
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1312
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\system32\rserver30"
        5⤵
        Views/modifies file attributes
        
        PID:3212
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\SysWOW64\rserver30"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:464
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\system32\r_server.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3564
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2572
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Telnet
        5⤵
        
        PID:1804
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        6⤵
        
        PID:4312
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config tlntsvr start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4988
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Service Host Controller"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Windows\SysWOW64\net.exe
        
        net user HelpAssistant /delete
        5⤵
        Indicator Removal: Network Share Connection Removal
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        6⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:1072
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn security /f
        5⤵
        
        PID:224
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="RealIP"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3608
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Service Host Controller"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2884
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3220
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete portopening tcp 57009
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4772
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="cam_server"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4324
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete portopening tcp 57011 all
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2904
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
        5⤵
        Modifies registry key
        
        PID:4848
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4796
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
        5⤵
        
        PID:3212
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:864
    - - C:\Windows\SysWOW64\catroot3\rutserv.exe
        
        "rutserv.exe" /silentinstall
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
    - - C:\Windows\SysWOW64\catroot3\rutserv.exe
        
        "rutserv.exe" /firewall
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4440
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s set.reg
        5⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2372
    - - C:\Windows\SysWOW64\catroot3\rutserv.exe
        
        "rutserv.exe" /start
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1964
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx001.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- C:\setup.exe
  "C:\setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im RManServer.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\System32\catroot3"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1800
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4704
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:228
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\de.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2288
    - - C:\Windows\SysWOW64\net.exe
        
        net stop rserver3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rserver3.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im r_server.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cam_server.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\system32\cam_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2356
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4544
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\system32\rserver30"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1108
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\SysWOW64\rserver30"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3456
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\system32\r_server.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2656
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5096
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Telnet
        5⤵
        
        PID:2728
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config tlntsvr start= disabled
        5⤵
        Launches sc.exe
        
        PID:4940
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Service Host Controller"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        6⤵
        
        PID:1020
    - - C:\Windows\SysWOW64\net.exe
        
        net user HelpAssistant /delete
        5⤵
        Indicator Removal: Network Share Connection Removal
        System Location Discovery: System Language Discovery
        
        PID:4648
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        6⤵
        Indicator Removal: Network Share Connection Removal
        System Location Discovery: System Language Discovery
        
        PID:3616
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn security /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="RealIP"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:64
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:808
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Service Host Controller"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4656
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete portopening tcp 57009
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="cam_server"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2732
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete portopening tcp 57011 all
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3964
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4356
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2060
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
    - - C:\Windows\SysWOW64\catroot3\rutserv.exe
        
        "rutserv.exe" /silentinstall
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784

C:\Windows\SysWOW64\catroot3\rutserv.exe
C:\Windows\SysWOW64\catroot3\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- - C:\Windows\SysWOW64\catroot3\rfusclient.exe
    C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:868
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
120B

MD5
d17970a0af7b0b32e133bf7c6afcc9a8

SHA1
35b458062431be19c60d52055dd5352859b97ae9

SHA256
f8a1a89c5eaf95a5294135e452bc6ad8bb5eabab1256f37243c9e56ca1267217

SHA512
256d048a0af8313848e4355db3d177554338655b31b5487c25297467c4ea2e1df51579c5f904bb541551fc3eeb5d056e68e1b3a85f6b3ba65a5d15996e5f4d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx001.cmd

Filesize
120B

MD5
8a31d6f5479ce86ce736e89cc2fbdfe2

SHA1
dfbaf647a39269658125be366cf0ce0977939aa2

SHA256
9830386c00c661099f30e7a5c1586fa3f3f8a8579e0f0999cd0e1b9ba9f61f4d

SHA512
4267ab9ecd73337f2bce43216180446ff5bf8b1c4c89298bb319fd0c3b4b4456a4b4020186cb8d3f4aa19a61ca1eb3cf296069635c63967655c32bb78f1538ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest

Filesize
1KB

MD5
d34b3da03c59f38a510eaa8ccc151ec7

SHA1
41b978588a9902f5e14b2b693973cb210ed900b2

SHA256
a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc

SHA512
231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PushSource.ax

Filesize
448KB

MD5
d7eb741be9c97a6d1063102f0e4ca44d

SHA1
bf8bdca7f56ed39fb96141ae9593dec497f4e2c8

SHA256
0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7

SHA512
cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll

Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RWLN.dll

Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\de.exe

Filesize
98KB

MD5
b8622a3042d7fa48b2e6de433007c870

SHA1
6399b9d115c3f1d3c5469f81b1a821bf75b75ae8

SHA256
cdb8330b9a36462dad63fb5c98520c4dd1cecf8a20d071bb0eff15ecf9fe0c98

SHA512
19450e826c78cc9526bf9ccba356fa63c8282ae3093db9ad71c1f21bcd80b3850b3aabbd2221fd6ddc293378df3d52ac0484c8882aeee517145d018ce3b4ed73

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll

Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll

Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
086a9fd9179aad7911561eeff08cf7e2

SHA1
d390c28376e08769a06a4a8b46609b3a668f728b

SHA256
2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

SHA512
a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
4KB

MD5
9abf3c42aaf72838183735217b5cea01

SHA1
3d052727ecc8974294da7afa1d63a7ebd052c2eb

SHA256
9215ce00c1168e012f73599605c575361e56b33c5f4123289ac4165a02350f98

SHA512
b6178a3bae692b688d70a4bb1396fb5a4c3025d641fc53fa1ef9273526c6812db4c83f89e606f7318e19ec44c89192d9d44d89f2a358b9481eb10c593e48bedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp80.dll

Filesize
541KB

MD5
8c53ccd787c381cd535d8dcca12584d8

SHA1
bc7ce60270a58450596aa3e3e5d0a99f731333d9

SHA256
384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

SHA512
e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcr80.dll

Filesize
617KB

MD5
1169436ee42f860c7db37a4692b38f0e

SHA1
4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

SHA256
9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

SHA512
e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfusclient.exe

Filesize
2.8MB

MD5
a90c6e72a9e2602560c521a1647664ad

SHA1
22f7f0ddb0af04df7109c3ddbb7027909041fa73

SHA256
579e5984ad5eb6e5e4b004acd01c95f609a1330f3900cd9851562eb4ac879197

SHA512
fbba623cab28c0648e8bdd03c99df9e2a84180d72ea8e63367e943f8b432ebc36a7e10a8bfce11ad1803e54a8514f1ded4fec72e680ee04386965b5eb6a5d6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\rutserv.exe

Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rversionlib.dll

Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.reg

Filesize
14KB

MD5
54338ceec07b7ad0c2df48a3554ceed4

SHA1
aabc2b5ab7507f79555dd9dcf92d72c2a97edbae

SHA256
c5fe24561dda93a8e03f6ab6384d92a3a07cb0bb94c7709d54d2dedbff05ea78

SHA512
ca6adf5a11666119a15790352437aa82a8a451099509035a6f9c68fd699cfafdc927bfc9886d4fc5ec2b02faef4947c3e08e60530e62727547573a15ef653712

Download Submit
C:\Users\Admin\AppData\Local\Temp\stop.js

Filesize
215B

MD5
804b35ef108ec9839eb6a9335add8ca1

SHA1
bf91e6645c4a1c8cab2d20388469da9ed0a82d56

SHA256
fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406

SHA512
822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d

Download Submit
C:\setup.exe

Filesize
2.4MB

MD5
c2e4a4ad4c46b753683ed89dfb53da06

SHA1
a48d390fea3fe3f687ce3bc114e20f848b75eaec

SHA256
5194c439d22de3cf80092dd77507d393506a72b6cf7aba946cdaa8f75a75070f

SHA512
e7509423732a75143265298b9b1be68a95099717fef658742da8d1dfcdd29e7cb9b71f048f6dd7ce95650df51da1c90edb724a42faa71047231fab885f87c12f

Download Submit
memory/868-219-0x00000000008C0000-0x0000000000918000-memory.dmp

Filesize
352KB

Download
memory/868-218-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/868-217-0x00000000008C0000-0x0000000000918000-memory.dmp

Filesize
352KB

Download
memory/1208-222-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/1208-223-0x0000000000990000-0x00000000009E8000-memory.dmp

Filesize
352KB

Download
memory/1208-209-0x0000000000990000-0x00000000009E8000-memory.dmp

Filesize
352KB

Download
memory/1840-211-0x0000000000860000-0x00000000008B8000-memory.dmp

Filesize
352KB

Download
memory/1840-201-0x0000000000860000-0x00000000008B8000-memory.dmp

Filesize
352KB

Download
memory/1840-210-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/1980-216-0x00000000008E0000-0x0000000000938000-memory.dmp

Filesize
352KB

Download
memory/1980-215-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/1980-191-0x00000000008E0000-0x0000000000938000-memory.dmp

Filesize
352KB

Download
memory/2588-182-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2588-183-0x0000000000C30000-0x0000000000C88000-memory.dmp

Filesize
352KB

Download
memory/2588-179-0x0000000000C30000-0x0000000000C88000-memory.dmp

Filesize
352KB

Download
memory/4440-192-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/4440-193-0x0000000000B30000-0x0000000000B88000-memory.dmp

Filesize
352KB

Download
memory/4440-187-0x0000000000B30000-0x0000000000B88000-memory.dmp

Filesize
352KB

Download
memory/4572-206-0x0000000000950000-0x00000000009A8000-memory.dmp

Filesize
352KB

Download
memory/4572-221-0x0000000000950000-0x00000000009A8000-memory.dmp

Filesize
352KB

Download
memory/4572-220-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/4572-226-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/4572-232-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/4572-263-0x0000000000950000-0x00000000009A8000-memory.dmp

Filesize
352KB

Download
memory/4660-224-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/4660-225-0x00000000009F0000-0x0000000000A48000-memory.dmp

Filesize
352KB

Download
memory/4660-208-0x00000000009F0000-0x0000000000A48000-memory.dmp

Filesize
352KB

Download
memory/4660-230-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/4660-242-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download