General
- Target https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware/
- Sample260430-hr4t8afv5m
Malware Config
Targets
-
- Target https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware/
Score10/10-
Family: RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Modifies Windows Defender Real-time Protection settings
-
UAC bypass
-
Windows security bypass
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Downloads MZ/PE file
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Users
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5