Analysis on legit tools
abused in humanoperated ransomware
Trend Micro
Incident Response TeamToru Yamashige, Yoshihiro Nakaya, Keisuke Tanaka

Who we are

Keisuke Tanaka
田中 啓介

Yoshihiro Nakaya
中谷 吉宏

Toru Yamashige
山重 徹

Trend Micro
Incident Response TeamIR Lead of JP Region

Trend Micro
Incident Response Team
Handler/Forensic Analyst

Trend Micro
Incident Response Team
Handler/Forensic Analyst

Over 10 years experience of IR
RISS, GCFA, GDAT, GOSIGCFACISSP, GCFA, GCFE, GPEN

2 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

――――――1st Chapter

Background&
Incident cases••

What is the “legit tool”?
Actual incident cases

Abuse of Legitimate tools• Attackers of Human Operated Ransomware tend to abuselegitimate tools for defense evasion.
• Tools intended for commercial use are currently
experiencing a marked increase in abuse.
Category of legitimate tools#

Category

Example1

MS Native Tools

PowerShell, PsExec, WMI, MSBuild, …

2

Pentest Tools

Cobalt Strike, Mimikatz, Bloodhound, …

3

Commercial Tools

AnyDesk, Splashtop, Rclone(MEGA), …

4 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Techniques arebeing well researched.
AV products are making
effort to detect them.

Our focus on
this presentation

Commercial tools• Commercial tools are typically used in enterprise daily
operations, making them challenging to detect at incidents.
• Due to their multifunctionality, those tools appear to beconvenient for attackers to perform various activities.
• Tend to be abused at the following tactics.
MITRE Tactics

Abused tools[TA0011] Command and Control

RMM Tools[TA0010] Exfiltration

SYNC Tools

5 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Commercial RMM tools• Once RMM agent program is installed/executed on victim PC,
an attacker will be able to remotely control the PC throughrelay servers as if accessing via Remote Desktop.
• Majority of tools have multiple features such as
script/command execution, file transfer, task manager, etc..
RMM Agent

RMM Server

Callback
Victim6 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Control
Relay Server

AttackerCommercial SYNC tools• Command-line/GUI based tool which syncs specific files ordirectories to cloud services or directly to target machines.
Cloud storage service
download
Cloud storage

Attacker
Client tool

uploadupload(cloud storage)(P2P)

Client tool
Victim
7 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Incident case example (case#1)
Tactics

Procedure

Initial Access-

Defense Evasion

Kill AV via legit driver

Credential Access

Mimikatz

Discovery

Advanced IP Scanner

Lateral Movement

PsExec, RDP

C&C

Atera,
Remote Utilities

Exfiltration-

ImpactBabuk Ransomware

8 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay Server

AttackerLAN
1.The victim unintentionallyinstalled attacker's Atera agent
1
3
2

Patient 0

3.Lateral >Encryption
Server

2.Attacker install Remote Utilities

Incident case example (case#2)
Tactics

Procedure

Initial Access

VPN

Defense Evasion

Disable AV

Credential Access

Mimikatz

Discovery

NW scanner

Lateral Movement

PsExec, RDP

C&C

Ngrok, AnyDesk

Exfiltration

Rclone->MEGA

ImpactBlackCat
Ransomware

9 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay Server

LAN

Attacker

VPN
1

3

1.Initial accessby SSL-VPN
2
3

Patient 0

Servers

2.Attacker install
AnyDesk & Ngrok

3.Lateral > Exfiltration> Encryption

Incident case example (case#1)

Attacker’s
Global IP
Attacker’s
email address

Atera RMM
Account ID

10 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date&Time of
Remote connectPurpose of this presentation
1

To clarify artifacts useful during investigation

2

To clarify methods to prevent malicious activities

Target RMM tools

Target SYNC tools

11 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

――――――2nd Chapter••

Analysis
Features of tools that may be abused by attackers
Artifacts useful for investigation

Verification Environment• Artifacts left during installation and execution of each tool features
were investigated.
• Only artifacts that are useful during the investigation are referred on
this document, rather than a comprehensive list of all the artifacts.
• Verification was done with the latest version of each tools as ofDecember 2022, and under the highest “free” license tiers.
• Only the artifacts on the client(victim) machine were investigated.
• If the tools is multifunctional, only the features that an attacker is likely
to abuse are verified.
• Verified on a Win10 environment. Other versions and OS are out of scope.
13 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Common useful artifact: SRUM
• System Resource Utilization Monitor• Windows feature that tracks application usage, network
utilizations, and performance information.
• Very useful artifact for both RMM and SYNC tools to locate...
1. When the tool was executed (approx. time)
2. How much data was sent/received with the tool
➢Date/Time when the attacker was active➢Amount of data which may have been exfiltrated
14 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Common useful artifact: SRUM
• SRUM collected from IR case where Atera RMM was abused.
Atera RMM was installed
on 2022 Sep-24th?

The attacker became active
between Sep-27th and 28th?

15 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Common useful artifact: SRUM
• SRUM collected from a terminal where data exfiltration via
FileZilla was attempted.

FileZilla was firstly executedon 2022 Sep-15th?

16 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Appox. 5.5GB was senton 2022 Oct-10th

Common useful artifact: EID 4688
• Windows Event ID: 4688(Security.evtx) is recordedwith command line when new process creation is detected.
• Must be carefully considered as Security.evtx could be overwhelmed→ EDR or Audit trail tools can be other options.
• 4688 is referred on this document only when other useful artifacts were
not found.

Creator Process Name: C: ¥Windows¥System32¥cmd.exe
Process Command Line: megatools.exe put 2.txt

17 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Tools Verification - AnyDesk
BlackByte, BlackCat, Cartel,Conti, Karakurt, LAPSUS$,
Quantum, Royal, Somnia

Target RMM tools

Target SYNC tools

18 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableAnyDesk : Artifacts
Installation•

Client program installation to the victim machine

Support GUI and Command Line installationGUI

GUI Installation
Command Line Installation

Command
AnyDesk.exe --install “%ProgramFiles(x86)%¥AnyDesk” --start-with-win --silent

19 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

AnyDesk : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles(x86)%¥AnyDesk¥*%ProgramFiles%¥AnyDesk¥*
Config[Install]%ProgramData%¥AnyDesk¥*.conf[Portable] %APPDATA%¥AnyDesk¥*.conf
system.conf

1
2

1.
2.
20 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

AnyDesk ID to connect from a remote machineFQDN of last connected relay serverAnyDesk : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

System.evtx (EventID: 7045)
Service
HKLM¥System¥CurrentControlSet¥Services¥AnyDesk• DisplayName: AnyDesk Service• ImagePath: “%ProgramFiles(x86)%¥AnyDesk¥AnyDesk.exe” --service

Processes persists
on victim

21 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Service Name

OthersAnyDesk : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersLog File[Install]%ProgramData%¥AnyDesk¥ad_svc.trace[Install/Portable] %APPDATA%¥AnyDesk¥ad.tracead_svc.trace/ad.trace

1
2

1.
2.

22 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

FQDN of connected relay server
IP address of relay serverAnyDesk : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

Network*.net.anydesk.com: 443,80,6568

FW rule for AnyDesk; Link
Dst port 443/tcp will fail overto 80, 5655 if blocked（443 ⇒ 80 ⇒ 6568）

23 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersAnyDesk : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Input Target(Victim) AnyDesk ID

Target monitor screen appearson the console and able to control*Copy-Paste b/w hosts-client is available

24 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

AnyDesk : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

Registry

Process/NW

OthersLog File[Install]%Programdata%¥AnyDesk¥ad_svc.trace[Portable] %APPDATA%¥AnyDesk¥ad.tracead_svc.trace/ad.trace
1.
2.
3.

1

AnyDesk ID of Remote machine (attacker)
Global IP address of Remote machine (attacker)
Private IP address of Remote machine (attacker)

2

3

25 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

AnyDesk : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

Registry

Process/NW

OthersLog File[Install]%Programdata%¥AnyDesk¥connection_trace.txt[Portable] %APPDATA%¥AnyDesk¥connection_trace.txt
connection_trace.txt
1

1.
2.

3.

2

Date/Time of remote access
Authentication Type•
User: Click the "Accept" button on the client side (victim)•
Passwd: Connect by entering the password on the remote machine (attacker).
•
Token: Connected with stored password.
AnyDesk ID and alias of the connection source (attacker)

26 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

3

AnyDesk : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

Registry

Process/NW

OthersLog File[Install]%Programdata%¥AnyDesk¥connection_trace.txt[Portable] %APPDATA%¥AnyDesk¥connection_trace.txt
1
2

Connect by inputting the password
on the remote machine (attacker)

3
2
3

Click the "Accept" button on
the client side (victim)

1
Connected with stored password

Remote (Attacker)
27 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Client (victim)

AnyDesk : Artifacts
Feature: Set Password•

Set password for Unattended Access on command line

Password for unattended access can be set on command line
* Administrative privileges required

Commandecho <Password> | AnyDesk.exe --set-password
Useful Artifacts

Files

EventLog
Security.evtx (Event ID: 4688)

28 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Password for remote connection can be set on command line

Registry

Process/NW

OthersAnyDesk : Artifacts
Feature: Set Password
Useful Artifacts

Set password for Unattended Access on command line
Files

Log File%APPDATA%¥AnyDesk¥ad.trace

Registry

Process/NW

OthersLog when setting password on command linead.trace

Config[Install]%ProgramData%¥AnyDesk¥service.conf and system.conf[Portable] %APPDATA%¥AnyDesk¥service.conf and system.conf
service.conf

If a password is set, the hash will be listed in the config.
29 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

system.conf

AnyDesk : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Possible to transfer files

30 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

AnyDesk : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%APPDATA%¥AnyDesk¥ad.trace
1

1.
2.
3.

Upload file from remote machine(attacker)
Download file from client machine(victim)
Delete file from client machine(victim)*Only file path but the file name is not showed2

3

31 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ad.trace

Tools Verification - Atera
Babuk, Black Basta,
BlackCat ,Conti

Target RMM tools

Target SYNC tools

32 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableAtera: Artifacts
Installation••

Agent program installation to the victim machine

A msi installer will be obtained from attacker’s tenant, thus no authentication isrequired during installation.
Splashtop is bundled with atera installer in default.
An installer can be
downloaded from the tenant

33 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Atera: Artifacts
Installation

Agent program installation to the victim machine

Useful Artifacts

Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles%¥Atera Networks¥* or %ProgramFiles(x86)%¥Atera Networks¥*
Log File%windir%¥Temp¥AteraSetupLog.txt
1

2
1

1.
2.

34 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of successful installation
Attacker’s email address and account ID

Atera: Artifacts
Installation
Useful Artifacts

Agent program installation to the victim machine
Files

Registry

Process/NW

OthersSystem.evtx (EventID: 7045)
Services
HKLM¥System¥CurrentControlSet¥Services¥AteraAgent• DisplayName: AteraAgent• ImagePath: %ProgramFiles%¥Atera Networks¥AteraAgent¥AteraAgent.exe

Config
HKLM¥Software¥Atera Networks¥AlphaAgent12

35 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

1.
2.

Acount ID of attacker’s Atera tenant
Attacker’s email

Atera: Artifacts
Installation
Useful Artifacts

Agent program installation to the victim machine
Files

Registry

Process/NW

Process%ProgramFiles%¥Atera Networks¥ATERA Networks¥AteraAgent¥AteraAgent.exe
Network
Processes persists
on victim• ps.pndsn.com: 443
IP/Port that the• *.atera.com: 443
process access to
FW rule for Atera; Link

36 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersAtera: Artifacts
Installation

Agent program installation to the victim machine

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Application.evtx (Event ID: 0, 1033, 11707)

1

1

1.

37 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of agent installation

Atera: Artifacts
Atera features

Features that attackers are likely to abuse during intrusion

Feature Name

DetailUseful Artifacts

Remote Access

Remote access to victim using Splashtop, AnyDesk, etc..

v

Software Inventory

View and remotely uninstall software on victim machine

Only 4688 Security Event

Run Script

Run any or build-in bat/ps1 scripts on victim machinev

Service Manager

Start, restart, or stop any services on victim machine

Only 4688 Security Event

Task Manager

View and end any tasks on victim machine

Only 4688 Security Event

Command Prompt

Control command prompt on victim machine and run any commands

Only 4688 Security Event

PowerShell

Control PowerShell on victim machine and run any commandsv

File Transfer

Send/Receive any file between attacker and victim

Only 4688 Security Event

Event Viewer

View Windows Event Log on victim machine

Only 4688 Security Event

Registry Editor

View and edit registry on victim machine

Only 4688 Security Event

38 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Atera: Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Atera employs 3rd party tools for remote access,thus the artifacts will be the same with thosegenerated by the corresponding tools.

39 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Atera: Artifacts
Feature: Run script

Run specific bat or ps1 scripts on victim machine

Build-in scripts are also provided
Manual script creation is supported

40 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Atera: Artifacts
Feature: Run script
Useful Artifacts

Run any or build-in bat/ps1 scripts on victim machine
Files

Registry

EventLog[ps1] Windows PowerShell.evtx (Event ID: 400)

Process/NW

EventLog[bat] Security.evtx (Event ID: 4688)

Microsoft-Windows-PowerShell/Operational.evtx(Event ID: 4104) will be also recorded with thecontent of ps1 if PowerShell script block is enabled.
1

1
2

2

1.
2.
41 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

File name of the script
Date/Time of script installation

OthersAtera: Artifacts
Feature: PowerShell

Control PowerShell on victim machine and run any commands

Take victim’s PowerShell and run commands

42 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Atera: Artifacts
Feature: PowerShell
Useful Artifacts

Control PowerShell on victim machine and run any commands
Files

Registry

Process/NW

OthersLog File%ProgramFiles%¥ATERA Networks¥AteraAgent¥Packages¥AgentPackageRunCommandInteractive¥log.txt
1

2

1.
2.

43 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Executed PowerShell command and date/time
Response of the commandTools Verification - CONNECTWISEALPHV, BlackCat,
RagnarLocker

Target RMM tools

Target SYNC tools

44 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableConnectWise : Artifacts
Installation•

Client program installation to the victim machine

Both exe and msi installer will be obtained from attacker’s tenant,thus no authentication is required during installation.

Installer typeInstaller Download

45 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ConnectWise : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles(x86)%¥ScreenConnect Client (<random>)¥*System.evtx (EventID: 7045)
Service
HKLM¥System¥CurrentControlSet¥Services¥ScreenConnect Client (<random>)• DisplayName: ScreenConnect Client (<random>)• ImagePath: "%ProgramFiles(x86)¥ScreenConnect Client(<random>)¥ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-<Instance ID>relay.screenconnect.com&p=443&s=<GUID>&k=<key>&v=<val>&c=<Company>&c=<Site>&c=<Depar
tment>&c=<DeviceType>&c=&c=&c=&c="46 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ConnectWise : Artifacts
Installation

Client program installation to the victim machine

Useful Artifacts

Files

Registry

Process/NW

EventLog
Application.evtx (Event ID: 1033, 11707)

1

1

1.

47 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of agent installation

OthersConnectWise : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

Process%ProgramFiles(x86)%¥ScreenConnect Client (<random>)¥ScreenConnect.ClientService.exe%ProgramFiles(x86)%¥ScreenConnect Client (<random>)¥ScreenConnect.WindowsClient.exe
Network*.screenconnect.com: 443

48 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersConnectWise : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Target monitor screen appearson the console and able to control*Copy-Paste b/w hosts-client is available

49 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ConnectWise : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

EventLog
Application.evtx (Event ID: 0、Source: ScreenConnect)

50 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW

OthersConnectWise : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Receive Folder…
Send Files…

51 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Send Folder…

Receive File…

ConnectWise : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Application.evtx (Event ID: 0、Source: ScreenConnect)

The event logs are recorded each times files aresent from attacker to victim.
The reverse transmission is not recorded.

52 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ConnectWise : Artifacts
Feature: Run Command

Run specific commands on victim machine

Select target and executespecific commands

53 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Command is executed by
NT AUTHORITY¥SYSTEM
User

ConnectWise : Artifacts
Feature: Run Command

Run specific commands on victim machine

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Application.evtx (Event ID: 0、Source: ScreenConnect)
Security.evtx (Event ID: 4688)
Security.evtx
Application.evtx

Only the length of the command is recorded.

54 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ConnectWise : Artifacts
Feature: Information Gathering•

Gather information from the managed computer

Process, service, software, and event logs can be manipulated
1

3

2

4

1
2
3
4

1.
2.
3.
4.
55 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

List and kill processes
List and uninstall application
Review a list of event logs
List, stop, start, and restart services

ConnectWise : Artifacts
Feature: Information Gathering
Useful Artifacts

Gather information from the managed computer

Files

Registry

Process/NW

Files％SystemRoot％¥TEMP¥ScreenConnect¥<Version>¥*.ps1 (Temporary file)
EventLog
Windows PowerShell.evtx (Event ID: 600,400,403)
Microsoft-Windows-PowerShell/Operational.evtx (Event ID: 4104)

Only ConnectWise-related PowerShell execution
can be confirmed, but detail is not logged
56 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

If script block logging is enabled,
specific process will be listed

OthersConnectWise : Artifacts
Feature: Information Gathering
Useful Artifacts

Gather information from the managed computer

Files

Registry

Process/NW

OthersEventLog
Application.evtx (Event ID: 0、Source: ScreenConnect)

57 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

LengthScript657

List running processes

861

List installed software492

Get recent events

460

List services

293,295,297…

Kill process (Depends on PID)

255,257,259…

Stop service (Depends on service name)340

Uninstall software (Application.evtx Event ID 1034, 11724)

Tools Verification - LogMeIn
LAPSUS$

Target RMM tools

Target SYNC tools

58 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableLogMeIn: Artifacts
Installation••

Install LogMeIn agent program on the victim machine

An agent msi installer will be obtained from attacker’s LogMeIn tenant.
An agent(victim) machine will be appeared on mgmt. console after installation.
A credential of victim machine is required to log in and to use LogMeIn features.

Windows user credential
is explicitly required

Agent(victim) machine

59 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

All the features will beavailable after log inLogMeIn: Artifacts
Installation

Install LogMeIn agent program on the victim machine

Useful Artifacts

Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles(x86)%¥LogMeIn¥*%LocalAppData%¥LogMeIn¥*%ProgramData%¥LogMeIn¥*
Log File%ProgramData%¥LogMeIn¥LogMeIn.log (file name will changed to “LMIyyyymmdd.log” after rotation)
1
2

1.
2.

60 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of agent installation and username
Date/Time of log in, IP address of remote terminal(attacker), username used for log inLogMeIn: Artifacts
Installation

Install LogMeIn agent program on the victim machine

Useful Artifacts

Files

Registry

Process/NW

System.evtx (EventID: 7045)
Services
HKLM¥System¥CurrentControlSet¥Services¥LMIGuardianSvc• ImagePath: “%ProgramFiles(x86)%¥LogMeIn¥x64¥LMIGuardianSvc.exe”
HKLM¥System¥CurrentControlSet¥Services¥LMIInfo• ImagePath: “%windir%¥system32¥drivers¥LMIInfo.sys”
HKLM¥System¥CurrentControlSet¥Services¥LMIMaint• ImagePath: “%ProgramFiles(x86)%¥LogMeIn¥x64¥RaMaint.exe”
HKLM¥System¥CurrentControlSet¥Services¥LMIRfsDriver• ImagePath: “%windir%¥system32¥drivers¥LMIRfsDriver.sys”
HKLM¥System¥CurrentControlSet¥Services¥LogMeIn• ImagePath: “%ProgramFiles(x86)%¥LogMeIn¥x64¥LogMeIn.exe”
Autoruns
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run• LogMeIn GUI: " %ProgramFiles(x86)%¥LogMeIn¥x64¥LogMeInSystray.exe”
61 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersLogMeIn: Artifacts
Installation

Install LogMeIn agent program on the victim machine

Useful Artifacts

Files

Registry

Process%ProgramFiles(x86)%¥LogMeIn¥x64¥*.exe
Processes persists
on victim
IP/Port that theprocess access to

62 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW
Network*.logmein.com: 443
FW rule for LogMeIn; Link

OthersLogMeIn: Artifacts
Installation

Install LogMeIn agent program on the victim machine

Useful Artifacts

Files

Registry

Process/NW

EventLog
Application.evtx (Event ID: 102, 105, 1033, 11707)
1

3
2

1.
2.
3.

63 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

IP address of attacker machine
Date/Time of logon
Date/Time of Installation

OthersLogMeIn: Artifacts
Feature: Remote Control

Control the victim machine as if accessing via Remote Desktop

Target monitor screen appearson the console and able to control*Copy-Paste b/w hosts-client is available

64 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

LogMeIn: Artifacts
Feature: Remote Control

Control the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramData%¥LogMeIn¥LogMeIn.log (file name will changed to “LMIyyyymmdd.log” after rotation)
1
2

1.
2.

Date/Time of remote control set up
Date/Time of remote control terminated with connection detail

Other
HKLM¥SOFTWARE¥LogMeIn¥V5¥FeatureHistory¥remotecontrol

3

65 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

3.

Number of remote control attempts

LogMeIn: Artifacts
Feature: Remote Control

Control the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

EventLog
Application.evtx (Event ID: 202, 205)
1

3

2

4

1.
2.
3.
4.
66 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

IP address of attacker machine
Date/Time of Remote Control started
IP address of attacker machine
Date/Time of Remote Control ended

OthersLogMeIn: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

File transfer between client and server
will be available

67 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

LogMeIn: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramData%¥LogMeIn¥LogMeIn.log (file name will changed to “LMIyyyymmdd.log” after rotation)
1

2

1.
2.

68 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of file transfer from attacker to victim, with fullpath
Date/Time of file transfer from victim to attacker, with fullpath

LogMeIn: Artifacts
Feature: File Share

Share specific files on the victim via email or download link

Download link of thetarget file is generated

69 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

LogMeIn: Artifacts
Feature: File Share
Useful Artifacts

Share specific files on the victim via email or download link
Files

Registry

Process/NW

OthersLog File%ProgramData%¥LogMeIn¥LogMeIn.log (file name will changed to “LMIyyyymmdd.log” after rotation)
1

Other
HKLM¥SOFTWARE¥LogMeIn¥V5¥WebSvc¥Shared¥<random>
2

1.
2.

70 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time when share link is created with fullpath of target file
Download linkTools Verification - ngrok
BlackCat, Daixin
SomniaTarget RMM tools

Target SYNC tools

71 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

Portablengrok : Artifacts
Feature:RemoteAccess Control
the victim
machineas if
accessing
RemoteDesktop
Feature:Configuration
Configurengrok
on victim
machineforviaremotecontrol•

An authtoken is issued when an account is created.

An authtoken is issued for each account.

72 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ngrok : Artifacts
Feature: Configuration

Configure ngrok on victim machine for remote control

Commandngrok.exe authtoken <Authtoken>

Useful Artifacts

Files

Registry

Process/NW

OthersConfig%LOCALAPPDATA%¥ngrok¥ngrok.yml
ngrok.yml
Authtoken is stored in a Yml file73 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ngrok : Artifacts
Feature: Configuration
Useful Artifacts

Configure ngrok on victim machine for remote control
Files

EventLog
Security.evtx (Event ID: 4688)

74 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

Othersngrok : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Commandngrok.exe tcp 3389

Ngrok Web console

After connecting, the client (victim) machine appears on the web console

75 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ngrok : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

EventLog
Security.evtx (Event ID: 4688)

76 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

Othersngrok : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

Registry

Process/NW

Network*.ngrok.com:443
FW rule for ngrok; Link

77 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Othersngrok : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop
ngrok Web console

FQDN and port for tunnel connection
78 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

ngrok : Artifacts
Feature: Remote Access
Useful Artifacts

Control the victim machine as if accessing via Remote Desktop
Files

Registry

Process/NW

EventLog
Securyty.evtx (Event ID: 4624)
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational.evtx (Event ID: 25)
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx (EventID: 131)

Log in events from itself are recorded

79 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersTools Verification – Remote Utilities
Babuk

Target RMM tools

Target SYNC tools

80 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableRemote Utilities: Artifacts
Execution/Installation••

Agent program installation and connect from attacker

Both portable(a.k.a Agent) and installer(a.k.a Host) are supported.
ID and password will be generated on client(victim) after execution/installation.
Attacker connects to the victim by using the credential.

Victim machine appears on
console after authentication

81 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Remote Utilities: Artifacts
Execution/Installation

Agent program installation and connect from attacker

Useful Artifacts

Files

Registry

Process/NW

OthersLog File[Portable] %APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyy-mm.html

1
2

3

1.
2.
3.
82 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of agent execution or installation
IP/Port of relay server
IP of attacker terminal

Remote Utilities: Artifacts
Execution/Installation

Agent program installation and connect from attacker

Useful Artifacts

Files

Registry

Process/NW

OthersSystem.evtx (EventID: 7045)
Services[Install]HKLM¥System¥CurrentControlSet¥Services¥RManService• ImagePath: %ProgramFiles(x86)%¥Remote Utilities - Host¥rutserv.exe

Config[Portable] HKCU¥Software¥Usoris¥Remote Utilities¥Host¥Parameters¥*[Install] HKLM¥Software¥Usoris¥Remote Utilities¥Host¥Parameters¥*

Config will appear after
base64 decode

83 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Remote Utilities: Artifacts
Execution/Installation

Agent program installation and connect from attacker

Useful Artifacts

Files

Registry

Process/NW

OthersProcess[Portable] %APPDATA%¥Remote Utilities Agent¥<version>¥<random>¥rutserv.exe[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥rutserv.exe
Processes persists
on victim

FQDN that the process resolves

84 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Network*.remoteutilities.com: 5655,443
FW rule for Remote Utilities; Link

Dst port 5655/tcp will failover to 443 if blockedRemote Utilities: Artifacts
Feature: File Transfer

85 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Transfer specific files between client(victim) and server(attacker)

Remote Utilities: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLog File[Portable] %APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyy-mm.html
1

2

86 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

1.
2.

Full path of received file
Full path of sent fileRemote Utilities: Artifacts
Feature: Task Manager

87 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Review working processes/services on the victim and control themRemote Utilities: Artifacts
Feature: Task Manager

Review working processes/services on the victim and control them

Useful Artifacts

Files

Registry

Process/NW

OthersLog File[Portable] %APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyy-mm.html
1

1.

88 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time when task manager is opened.
*Detail of the action is not recorded.

Remote Utilities: Artifacts
Feature: Terminal

89 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Open cmd or PowerShell terminal of the victim machineRemote Utilities: Artifacts
Feature: Terminal
Useful Artifacts

Open cmd or PowerShell terminal of the victim machine
Files

Registry

Process/NW

OthersEventLog
Security.evtx (Event ID: 4688)

2

1

90 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

3

rutserv.exe -> cmd.exe -> whoami

Remote Utilities: Artifacts
Feature: Execution

Useful Artifacts

Remotely execute specific application on victim machine.

Files

Registry

Process/NW[Portable] %APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyy-mm.html

91 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersRemote Utilities: Artifacts
Feature: Remote registry

92 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Review and control registry on victim machineRemote Utilities: Artifacts
Feature: Remote registry

Review and control registry on victim machine

Useful Artifacts

Files

Registry

Process/NW

OthersLog File[Portable] %APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html[Install] %ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyy-mm.html
1

1.

93 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time when remote registry is opened.
*Detail of the action is not recorded.

Tools Verification - Splashtop
Babuk, Black Basta,
Ragnar Locker

Target RMM tools

Target SYNC tools

94 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableSplashtop: Artifacts
Installation•

Agent program(=streamer) installation to the victim machine

Silent installation is supported for both exe and msi, which bypasses manual
authentication and connects to attacker’s tenant automatically.

Normal installation
requires authentication

Authentication is skipped
and automatically connects
to attacker’s tenant>streamer.exe prevercheck /s /i dcode=<distribution code>, confirm_d=0, hidewindows=1

95 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Splashtop: Artifacts
Installation
Useful Artifacts

Agent program(=streamer) installation to the victim machine
Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles(x86)%¥Splashtop¥*%ProgramData%¥Splashtop¥*%LOCALAPPDATA%¥Splashtop¥*
System.evtx (EventID: 7045)
Services
HKLM¥System¥CurrentControlSet¥Services¥SplashtopRemoteService• DisplayName: Splashtop® Remote Service• ImagePath: %ProgramFiles(x86)%¥Splashtop¥Splashtop Remote¥Server¥SRService.exe
HKLM¥System¥CurrentControlSet¥Services¥SSUService• Display Name: Splashtop Software Updater Service• ImagePath: %ProgramFiles(x86)%¥Splashtop¥Splashtop Software Updater¥SSUService.exe

96 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Splashtop: Artifacts
Installation
Useful Artifacts

Agent program(=streamer) installation to the victim machine
Files

Registry

Process/NW

Process%ProgramFiles(x86)%¥Splashtop¥Splashtop Remote¥Server¥SR*.exe
Network
Processes persists
on victim*.splashtop.com: 443
FW rule for Splashtop; Link
IP/Port that theprocess access to

97 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersSplashtop: Artifacts
Installation

Agent program(=streamer) installation to the victim machine

Useful Artifacts

Files

Registry

Process/NW

EventLog
Splashtop-Splashtop Streamer-Remote Session Operational.evtx (Event ID: 1, 200)
Application.evtx (Event ID: 1033, 11707)
1

2

2

1.
2.

98 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Account name of Splashtop (email address)
Date/Time of streamer installation

OthersSplashtop: Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Target monitor screen appearson the console and able to control*Copy-Paste b/w hosts-client is available

99 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Splashtop: Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

Others%ProgramFiles(x86)%¥Splashtop¥Splashtop Remote¥Server¥log¥SPLog.txt
1

2

3
4

100 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

1.
2.
3.
4.

FQDN of relay server
Date/Time of connection
Hostname of attacker machine
Account name of Splashtop(email address)

Splashtop: Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersConfig
HKLM¥SOFTWARE¥WOW6432Node¥Splashtop Inc.¥Splashtop Remote Server¥ClientInfo

1
2
3

1.
2.
3.

101 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Global IP address of attacker
machineAccount name of Splashtop(email address)
Hostname of attacker machineSplashtop: Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Splashtop-Splashtop Streamer-Remote Session Operational.evtx (Event ID: 1000, 1001)
11

22

33

1.
2.
3.

102 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Account name of Splashtop (email address)and hostname of attacker machine
Date/Time of connection started
Date/Time of connection ended

Splashtop: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

File transfer between client and server
will be available

103 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Splashtop: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramData%¥Splashtop¥Temp¥log¥FTCLog.txt
1

Log File%ProgramFiles(x86)%¥Splashtop¥Splashtop Remote¥Server¥log¥SPLog.txt
2
3

1.
2.
3.

104 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of file upload and download, with the filepaths and account name/global IP address of attacker
Date/Time of file upload with the file path and size
Date/Time of file download with the file path and size

Splashtop: Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Splashtop-Splashtop Streamer-Remote Session Operational.evtx (Event ID: 1100, 1101)

1

1

2

2

3

3

1.
2.
3.

105 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

File name of uploaded/downloaded
Hostname of attacker machine
Date/Time of file upload/download

Tools Verification – SupRemo
Babuk

Target RMM tools

Target SYNC tools

106 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableSupRemo: Artifacts
Installation
Useful Artifacts

Agent program installation and connect from attacker
Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles(x86)%¥Supremo¥*
Log File%ProgramData%¥SupremoRemoteDesktop¥Log¥SupremoService.00.Service.log
11.
System.evtx (EventID: 7045)
Service
HKLM¥System¥CurrentControlSet¥Services¥SupremoService• DisplayName: Supremo• ImagePath: %ProgramFiles(x86)%¥Supremo¥SupremoService.exe

107 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of installation completed

SupRemo: Artifacts
Installation

Agent program installation and connect from attacker

Useful Artifacts

Files

Registry

Process/NW

Process%ProgramFiles(x86)%¥Supremo¥Supremo.exe
Processes persists
on victim
IP/Port that theprocess access to

108 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Network*.nanosystems.it: 443,5938
FW rule for Splashtop; Link

OthersSupRemo: Artifacts
Feature: Remote Control••

Control the victim machine as if accessing via Remote Desktop

ID and password will be generated on victim machine after installed/executed.
Attacker will use the credential to connect victim machine. A designated
SupRemo account is not necessarily required to connect.

Target monitor screen appears and able to control*Copy-Paste b/w hosts-client is available

109 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

SupRemo: Artifacts
Feature: Remote Control

Control the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.Client.log

1%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.Incoming.log
2%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.ReportsQueue.log
3

1.
2.
3.
110 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Hostname and port of relay server
Hostname of attacker
Date/Time of session start and end

SupRemo: Artifacts
Feature: File Manager

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

Others%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.FileTransfer.log
1

1.

111 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Date/Time of files send/receiveTools Verification - TeamViewer
BlackBasta, BlackCat
LAPSUS$, Lockbit 3.0,
Royal

Target RMM tools

Target SYNC tools

112 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableTeamViewer : Artifacts
Execution/Installation••

Client program installation to the victim machine

Both exe and msi installer will be obtained from Web console.
（An account is not required to use TeamViewer.)
Silent installation is supported.

Add client

Command
TeamViewer_Setup.exe /S /D=<Install Dir>

113 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Download Installer

TeamViewer : Artifacts
Execution/Installation

Useful Artifacts

Client program installation to the victim machine

Files

Registry

Process/NW

Install Path
%ProgramFiles(x86)%¥TeamViewer¥*%ProgramFiles%¥TeamViewer¥*%TEMP%¥TeamViewer¥*
Registry
HKLM¥SOFTWARE¥TeamViewer
HKLM¥SOFTWARE¥WOW6432Node¥TeamViewer
HKLM¥SOFTWARE¥WOW6432Node¥TVInstallTemp
1.
2.
3.
4.

1
2
114 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Client ID(TeamViewer ID) to connect from a remote machine
Installation directory
Account name of TeamViewer
Date the password was last set

34

OthersTeamViewer : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersLog File / Config%TEMP%¥TeamViewer¥TV15Install.log%TEMP%¥TeamViewer¥tvinfo.ini
TV15Install.log

tvinfo.ini

Installer file nameVersion and User

115 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TeamViewer : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

System.evtx (EventID: 7045)
Service
HKLM¥SYSTEM¥CurrentControlSet¥Services¥TeamViewer• DisplayName: TeamViewer• ImagePath: %ProgramFiles%¥TeamViewer¥TeamViewer_Service.exe

Processes persists
on victim

116 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Service Name

OthersTeamViewer : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

Process[Install]%ProgramFiles(x86)%¥TeamViewer¥TeamViewer_Service.exe[Install]%ProgramFiles%¥TeamViewer¥TeamViewer_Service.exe[Portable] <Dir>¥TeamViewer.exe
Install

Portable

117 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Network*.teamviewer.com: 5938,443,80
FW rule for TeamViewer; Link

OthersTeamViewer : Artifacts
Execution/Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersLog%ProgramFiles(x86)%¥TeamViewer¥TeamViewer15_Logfile.log%ProgramFiles%¥TeamViewer¥TeamViewer15_Logfile.log
TeamViewer15_Logfile.log

FQDN and IP address

118 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TeamViewer : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Enter the TeamViewer ID of the target(victim)
machine and click the "Connect" button.

Useful Artifacts

Files

Registry

Process/NW

Process[Install]%ProgramFiles(x86)%¥TeamViewer¥TeamViewer_Desktop.exe[Install]%ProgramFiles%¥TeamViewer¥TeamViewer_Desktop.exe[Portabel] <Dir>¥TeamViewer_Desktop.exe

119 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersInstall

PortableTeamViewer : Artifacts
Feature: Remote Access•Control the victim machine as if accessing via Remote Desktop

Supports some authentication methods
Random passwords

1

1
2

Personal password(Permanent password)

Input random or personal password

2

3
3
Click “Connect” button on TeamViewr Web site
• TeamViewer account required• Device(client machine) authorization needed• No random or personal password is required
120 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Remote (Attacker)

Client (victim)
Easy access (Unattended Access)
Need to be logged in to TeamViewer accountTeamViewer : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramFiles(x86)%¥TeamViewer¥TeamViewer15_Logfile.log%ProgramFiles%¥TeamViewer¥TeamViewer15_Logfile.log
TeamViewer15_Logfile.log
1
2

4

5
121 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

3

1.
2.
3.
4.
5.

Password authentication
TeamViewer ID of the remote machine (attacker)
Hostname or account name of the remote machine (attacker)
Global IP address of the remote machine (attacker)
Disconnection and its date/timeTeamViewer : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%ProgramFiles(x86)%¥TeamViewer¥Connections_incoming.txt%ProgramFiles%¥TeamViewer¥Connections_incoming.txt
1

2

Connections_incoming.txt

3

1.
2.
3.

122 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TeamViewer ID of the remote machine (attacker)
Hostname or account name of the remote machine (attacker)
Date/Time remote machine connected/disconnected (UTC)TeamViewer : Artifacts
Feature: File Transfer

123 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Transfer specific files between client(victim) and server(attacker)

TeamViewer : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLogs File%ProgramFiles(x86)%¥TeamViewer¥Connections_incoming.txt%ProgramFiles%¥TeamViewer¥Connections_incoming.txt
Log when "1.exe" is sent from a remote machine to a target machine1

1. Files sent from the remote(attacker) machine to the target(victim) machine124 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TeamViewer15_Logfile.log

TeamViewer : Artifacts
Feature: File Transfer

Transfer specific files between client(victim) and server(attacker)

Useful Artifacts

Files

Registry

Process/NW

OthersLogs File%ProgramFiles(x86)%¥TeamViewer¥Connections_incoming.txt%ProgramFiles%¥TeamViewer¥Connections_incoming.txt
Log when "data.zip" from target(victim) machine is sent to remote (attacker) machine

TeamViewer15_Logfile.log

1

1.

125 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Files sent from the target(victim) machine to the remote (attacker) machineTools Verification – Tight VNC
REvil, BianLian

Target RMM tools

Target SYNC tools

126 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Relay

DirectInstall

PortableTightVNC : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

Install Path
%ProgramFiles(x86)%¥TightVNC%ProgramFiles%¥TightVNC
Registry
HKLM¥SOFTWARE¥TightVNC
HKCU¥Software¥TightVNC¥Server
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run• tvncontrol: "%ProgramFiles%¥TightVNC¥tvnserver.exe" -controlservice –slave
System.evtx (EventID: 7045)
Service
HKLM¥SYSTEM¥CurrentControlSet¥Services¥tvnserver• DisplayName: TightVNC Server• ImagePath: “%ProgramFiles%¥TightVNC¥tvnserver.exe” -service

127 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersTightVNC : Artifacts
Installation

Agent program installation to the victim machine

Useful Artifacts
Files
EventLog
Application.evtx (Event ID: 1033, 11707)

Registry1

1

1.

128 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW

Date/Time of agent installation

OthersTightVNC : Artifacts
Installation

Agent program installation to the victim machine

Useful Artifacts
Files
Registry
EventLog
Application.evtx (Event ID: 257、Source: tvnserver)

129 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW

OthersTightVNC : Artifacts
Feature: Remote Access•Control the victim machine as if accessing via Remote Desktop

Support ReverseVNC connection
Command - VNC Client (Attacker)
tvnviewer.exe -listen
Command - VNC Server (Victim)[Porable] tvnserver.exe -controlapp -connect <IP address>[: Port][Install]tvnserver.exe -controlservice -connect <IP address>[: Port]
ReverseVNC
tvnviewer.exe
1.
2.

tvnserver.exe

VNC client listens for an incoming connection fromthe VNC server (Default port 5500)
Connect from VNC server using ReverseVNC

130 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TightVNC : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts
Files
Registry
EventLog
Application.evtx (Event ID: 257、Source: tvnserver)

Process/NW

OthersOnly If installed and used as a service, an event log is recorded (use “-controlservice” command option)

131 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

TightVNC : Artifacts
Feature: Remote AccessControl the victim machine as if accessing via Remote Desktop

Useful Artifacts

Files

EventLog
Security.evtx (Event ID: 4688)

132 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

OthersTightVNC : Artifacts•

Feature: File Transfer

Agent program installation and connect from attacker

Useful Artifacts

Files

Registry

Process/NW

No particularly useful artifact were identified. (SRUM may be useful)133 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

OthersTools Verification – FileZilla
Cuba, Karakurt,
Lockbit2.0, Lorenz

Target RMM tools

Target SYNC tools

134 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

Portable

FileZilla : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersInstall Path
%ProgramFiles%¥FileZilla FTP Client¥
Files%ProgramData%¥Microsoft¥Windows¥Start Menu¥Programs¥FileZilla FTP Client¥FileZilla.lnk• Target: %ProgramFiles%¥FileZilla FTP Client¥filezilla.exe%ProgramData%¥Microsoft¥Windows¥Start Menu¥Programs¥FileZilla FTP Client¥Uninstall.lnk• Target: %ProgramFiles%¥FileZilla FTP Client¥uninstall.exe
Other
HKLM¥SOFTWARE¥WOW6432Node¥FileZilla Client¥*

135 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

FileZilla : Artifacts
Feature: Data Transfer

136 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Transfer specific files or directories

FileZilla : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files%APPDATA%¥FileZilla¥filezilla.xml
1
2

3

137 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

Others%APPDATA%¥FileZilla¥recentservers.xml
12

1. Remote IP address
2. FTP server username and password(encoded)
3. Local and remote path of exfiltration(Only the latest session is recorded)Tools Verification - FreeFileSync
Lockbit, REvil

Target RMM tools

Target SYNC tools

138 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

PortableFreeFileSync : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Install Path
%ProgramFiles(x86)%¥FreeFileSync¥*%ProgramFiles%¥FreeFileSync¥*
Registry
HKLM¥SOFTWARE¥WOW6432Node¥FreeFileSync

139 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW

OthersFreeFileSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

GUI

FreeFileSync supports synchronization
with Google Drive, SFTP and FTP.

Command
FreeFileSync.exe <FreeFileSync batch job configuration file>140 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

FreeFileSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

OthersFiles%APPDATA%¥FreeFileSync¥GlobalSettings.xml%APPDATA%¥FreeFileSync¥LastRun.ffs_gui%APPDATA%¥FreeFileSync¥GoogleDrive¥<GoogleDrive account>.db
GlobalSettings.xml

History of selected folders and synchronization destinations

LastRun.ffs_gui

The last synchronized directory pair isrecorded.

When GoogleDrive is specified as the synchronization
destination, a file containing the account name is generated.
141 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

FreeFileSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

OthersLog File%APPDATA%¥FreeFileSync¥Logs¥[Last session] yyyy-mm-dd hhmmss.SSS*.html
Google Drive

1.
2.
1

SFTP

Synchronized folders
Created (uploaded) file1

2

142 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

2

FreeFileSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Files<Sync target directory>¥sync.ffs_db

This file will be created in the synced folder

143 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW

OthersTools Verification – GoodSync-

Target RMM tools

Target SYNC tools

144 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

Portable

GoodSync : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersInstall Path
%ProgramData%¥Siber Systems¥GoodSync¥*
Log File%LOCALAPPDATA%¥GoodSync¥InstallLicense-yymmdd-hhmm.log
1

2

1.
2.

Date/Time of successful installation
Attacker’s email address

System.evtx (EventID: 7045)
Services
HKLM¥System¥CurrentControlSet¥Services¥GsServer• DisplayName: GoodSync Server• ImagePath: “%ProgramFiles%¥Siber Systems¥GoodSync¥gs-server.exe” /service

145 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

GoodSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Files in the selected directory
will be copied to remote.

Remote terminals and services
where files will be exfiltrated to.

146 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

GoodSync : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

Others%LOCALAPPDATA%¥GoodSync¥GoodSync-<yymmdd>-<hhmm>.log
1
2

1.
2.

FQDN/IP address of Client(victim), Relay server, and Server(attacker)
Local and remote fullpaths of exfiltrated files%LOCALAPPDATA%¥GoodSync¥server-accounts.tic
3

3

3.

147 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Email address registered in GoodSync and used service

Tools Verification – MEGA TOOLS-

Target RMM tools

Target SYNC tools

148 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

Portablemegatools : Artifacts
Feature: Data Transfer•

Transfer specific files or directories“put” and “copy” option would be used for exfiltration.
• Put: Upload individual files• Copy: Upload or download a directory tree
>megatools.exe put <file name> -u <email> -p <password>>megatools.exe copy –local <local path> --remote <remote path> -u <email> -p <password>•

Email/password can be omitted from the command line by storing ini file on thesame directory as megatool.exe, listing email/password in plaintext.

149 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

megatools : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

OthersOther%Temp%<random>.megatools.cache•Previous session cache (encoded)= proof of communication attempts using megatools
Config<same directory as megatool.exe>¥mega.ini

1

150 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

1.

Username(Email) and password of attacker’s
Mega accountmegatools : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

OthersEventLog
Security.evtx (Event ID: 4688)

1.
1

151 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Execution of megatools with command line
(file/directory name might be listed)Tools Verification - Rclone
Babuk,Black Basta,Conti
Black Cat,Cartel,Lockbit2.0/3.0
Daixin,Hive,Karakurt...etc

Target RMM tools

Target SYNC tools

152 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

PortableRclone : Artifacts
Feature: Configuration

Configure rclone to sync data from one storage system to another

Support for a large number of providers (over 40)• Amazon S3• Dropbox• Google Drive• Microsoft OneDrive• Mega• FTP• HTTP• SFTP• WebDAV
etc…

153 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Rclone : Artifacts
Installation

GUI installation to the victim machine

Commandrclone.exe rcd --rc-web-gui
Run this command and rclone will download
and then display the GUI in a web browser.

154 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Rclone : Artifacts
Installation
Useful Artifacts

GUI installation to the victim machine
Files

Files
%LOCALAPPDATA%¥rclone¥webgui

155 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

OthersRclone : Artifacts
Feature: Configuration

Configure rclone to sync data from one storage system to another

Commandrclone.exe config
rclone.exe config create <Name> <Cloud Storage Type> user <User ID> pass <Password>
Useful Artifacts

Files

Config%APPDATA%¥rclone¥rclone.conf

Running “rclone config” command creates rclone.conf.

156 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

OthersRclone : Artifacts
Feature: Data Transfer

Transfer specific files or directories to Cloud storage

Commandrclone.exe [copy|sync] [--config=CONFIG_FILE] <Local path> <Name>: <Remote path>rclone.exe [copy|sync] [--config=CONFIG_FILE] <Local path> <Name>: <Remote path> -q --ignore-existing -auto-confirm --multi-thread-streams 12 --transfers 12
Command - Example
rclone.exe copy --config=C: ¥temp¥rclone.conf “C: ¥data” remote: data -q --ignore-existing --auto-confirm

157 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Rclone : Artifacts
Feature: Data Transfer

Transfer specific files or directories to Cloud storage

Useful Artifacts

Files

EventLog
Security.evtx (Event ID: 4688)

158 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Registry

Process/NW

OthersTools Verification - WinSCP
Babuk, PLAY,
Luna moth, MONTI

Target RMM tools

Target SYNC tools

159 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

CLI

GUI

Relay

DirectInstall

PortableWinSCP : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Install Path
%ProgramFiles(x86)%¥WinSCP¥*%USERPROFILE%¥AppData¥Local¥Programs¥WinSCP¥*
Registry
HKLM¥SOFTWARE¥Martin Prikryl¥WinSCP 2
HKLM¥SOFTWARE¥WOW6432Node¥Martin Prikryl¥WinSCP 2
HKCU¥Software¥Martin Prikryl¥WinSCP 2
HKCR¥winscp-*

160 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Process/NW(For All User)(For Own)

OthersWinSCP : Artifacts
Installation
Useful Artifacts

Client program installation to the victim machine
Files

Registry

Process/NW

OthersRegistry
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP 2¥Sessions¥*

1
2

3

2
4
3

4
1

Registered login information is stored in the registry by default

161 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

WinSCP : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Commandwinscp.exe [(sftp|ftp|scp): //][User[: Password]@]Host [: Port][/<Path>/[Filename]]162 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

WinSCP : Artifacts
Feature: Data Transfer

Transfer specific files or directories

Useful Artifacts

Files

Registry

Process/NW

Registry
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP 2¥Configuration¥CDCache
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP 2¥Configuration¥LastFingerprints

IP Address of remote server and used protocol

163 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Others――――――3rd Chapter

Countermeasures••

How to containment
How to prevention and monitoringOutline of Countermeasures
Containment

Prevention & Monitoring

Investigate clients

Survey the tool usage

Locate abused legit tools

Determine allowed/disallowed tools

Control abused legit tools

Control the disallowed tool

Scope the impact

Set up alert monitoring system andoperational flow

165 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Outline of Countermeasures• Block outbound communications is the most effective.
• Block agent execution with AppLocker could be also effective,
but will not work if the agent is already running with system privileges.

• It is recommended to control by "product name" or “Publisher"of each exe and msi after uninstalling them.
MethodEffectiveness

Block outbound communications◎

Block application executions〇

Block Installer executions〇

166 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Supplement: Out of Scope• Root countermeasures such as the following examples are not includedin this document• Intrusion prevention by ransomware actors• Public port control tied to Global IP• Checking and controlling the publication status of 3389 in particular• Identification of SSL-VPN devices• Two-factor authentication and restriction of source IP• Identification of administrator accounts, minimization and password
strengthening• Separation of client terminal privileges• LAN segmentation (VLAN, unnecessary port blockage, etc.)

167 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Countermeasure: Containment
Containment

Prevention & Monitoring

Investigate clients

Survey the tool usage

Locate abused legit tools

Determine allowed/disallowed tools

Control abused legit tools

Control the disallowed tool

Scope the impact

Set up alert monitoring system andoperational flow

168 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Investigate > Locate
1. Investigate and create the breach timeline✓ MFT*, event logs, audit trail tools (e.g. Skysea,lanscope)

2. Locate abused legitimate tools installed around the time of the breach✓ The following image shows an example of AnyDesk installation

MFT*MFT: Master File Table169 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

System event log (ID: 7045)

Control > Scope (1/2)
1. Control the outbound communication from the tools
by web filtering, proxy, etc.
2. Control the tool execution by publisher, product name
3. Investigate client where the tool is deployed, locating from
communication logs
4. Timeline investigation and interview the user to determine
whether the tool was installed intentionally or was abusedby an attacker.

170 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Control > Scope (1/2)
1. Control the outbound communication from the tools
by web filtering, proxy, etc.
2. Control the tool execution by publisher, product name.
3. Investigate client where the tool is deployed from
communication logs
4. Timeline investigation and user hearing to determine
whether the tool was installed intentionally or was abusedby an attacker.
Controlling outbound communication (Fortigate)

171 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Controlling tool by product name (AppLocker)

Considerations: Controlling the tool
• AppLocker logs are recorded to the local event log• =Difficult to aggregate logs, thus it is better to locate the compromised hosts
first through outbound communication, and then consider execution control• Instead, security products or audit trail tools normallysupport log aggregation.

Event log (AppLocker – EXE and DLL)
172 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Considerations: Controlling the tool
• Controlling the tolls by publisher or product name can be bypassed byremoving the signature from the tools.
• If you afraid bypass,enable "Only elevate executables that are signed
and validated" in the security policy to control unsigned executable files.
•

It is necessary to consider the operational impact on self-developed tools, etc.

Local Security Policy (UAC Part)
AppLocker
173 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Countermeasure:Prevention&Monitoring
Containment

Prevention & Monitoring

Investigate clients

Survey the tool usage

Locate abused legit tools

Determine allowed/disallowed tools

Control abused legit tools

Control the disallowed tool

Scope the impact

Set up alert monitoring system andoperational flow

174 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Survey > Determine• Survey the tool usage
1. Investigate communication log, audit trail logs, etc..
2. Locate who is using in what purpose
3. Interview the user if the tool is for operation or private use• Determine allowed/disallowed tools
1. Disallowed tool must be prohibited, or users must request
for approval each time they use
2. Remove the disallowed tools which are already in use
175 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Control > Set up• Control the disallowed tool
• Via FW, file name, or product name• Recommended to start from controlling via FW• Set up alert monitoring system and operational flow
• Check if the detection is expected or not• Date and time, user interview, etc..

176 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Classification example
Tool usage
Tools allowed to
all the employees
Tools allowed topart of the employees
Disallowed tools

177 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Host category
Allowed host

Disallowed hostControl and monitor only Server OS-

Control and monitor
communication and tool
installation & executions

Control and monitor communicationand tool installation & executions

Prevention & Monitoring tips
• At first, pay particular attention to RMM/SYNC tool execution
on Server OS since it is unlikely during daily operations• Utilize Web Filtering Categories (e.g. file storage services)
instead of registering disallowed URL one by one• Utilize EDR product rules or custom queries to investigate
and visualize the tool usage

178 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Wrap upThis document refers to:• How the legit tools are being abused in recent humanoperated ransomware.
• The tools specification and useful artifacts for investigation.
• How to contain, prevent and monitor the attack.

Next action:• Please utilize Appendix information for your incident response
and monitoring!

179 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

――――――Ex Chapter

Appendix••

A list for tool control
Artifacts summary

A list for tool control• A list on next page refers to..
1. URLs to block communication between agents and the tool destinations
2. Product Name and Publisher to block execution of each the tools by AppLocker

Publisher
Rules to control exe files
Product Name
Communication will be timed out

Rules to control msi files

AppLocker settings
181 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

A list for tool control
Tool

URL to block

Product Name

Publisher

AnyDesk*.net.anydesk.com

ANYDESK[exe] O=PHILANDRO SOFTWARE GMBH, L=STUTTGART, S=BADEN-WÜRTTEMBERG, C=DE

Atera*.atera.com, ps.pndsn.com

ATERAAGENT[msi] O=ATERA NETWORKS LTD, L=TEL AVIV-YAFO, C=IL

ConnectWise*.screenconnect.com

SCREENCONNECT[exe] O=CONNECTWISE, LLC, L=TAMPA, S=FLORIDA, C=US

LogMeIn*.logmein.com

LOGMEIN[msi] O=LOGMEIN, INC., L=BOSTON, S=MASSACHUSETTS, C=US

Ngrok*.ngrok.com

NGROK AGENT[exe] O=NGROK, INC., L=SAN DIEGO, S=CALIFORNIA, C=US

Remote Utilities*.remoteutilities.com

REMOTE UTILITIES[exe] O=REMOTE UTILITIES LLC, L=MOSCOW, C=RU

Splashtop*.splashtop.com

SPLASHTOP® STREAMER[exe] O=SPLASHTOP INC., L=SAN JOSE, S=CALIFORNIA, C=US

SupRemo*.nanosystems.it

SUPREMO REMOTE CONTROL[exe] O=NANOSYSTEMS S.R.L., L=ASCOLI PICENO, S=ASCOLI PICENO, C=ITTeamViewer*.teamviewer.com

TEAMVIEWER[exe] O=TEAMVIEWER GERMANY GMBH, L=GÖPPINGEN, S=BADEN-WÜRTTEMBERG, C=DE

TightVNC-

TIGHTVNC[msi] O=GLAVSOFT, OOO, L=TOMSK, S=TOMSKAYA OBLAST, C=RU

FileZilla

Depends on target services

FILEZILLA[exe] O=TIM KOSSE, S=NORDRHEIN-WESTFALEN, C=DE

FreeFIleSync

Depends on target services

FREEFILESYNC[exe] O=FLORIAN BAUER, S=BAVARIA, C=DEGoodSync*.goodsync.com / target services

GOODSYNC[exe] O=SIBER SYSTEMS, L=FAIRFAX, C=US

Megatools*.mega.co.nz--

RcloneDepends on target services--

WinSCP

Depends on target services

WINSCP[exe] O=MARTIN PRIKRYL, L=PRAGUE, C=CZ

182 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Artifacts Summary (RMM)
Tool

Category

Artifacts

Tool

Category

Artifacts

AnyDesk

MFT%APPDATA%¥AnyDesk¥ad.trace%APPDATA%¥AnyDesk¥connection_trace.txt%APPDATA%¥AnyDesk¥*.conf%ProgramData%¥AnyDesk¥*.conf%ProgramData%¥AnyDesk¥ad_svc.trace%Programdata%¥AnyDesk¥connection_trace.txt%ProgramFiles%¥AnyDesk¥*%ProgramFiles(x86)%¥AnyDesk¥*

ConnectWise

MFT%ProgramFiles(x86)%¥ScreenConnect Client (<random>)¥*%SystemRoot%¥TEMP¥ScreenConnect¥<Version>¥*.ps1

ConnectWise

Registry

HKLM¥System¥CurrentControlSet¥Services¥ScreenConnect Client (<random>)ConnectWise

Event Log

Application.evtx (Event ID: 0, 1033, 11707)
Microsoft-Windows-PowerShell/Operational.evtx (Event ID: 4104)
Windows PowerShell.evtx (Event ID: 600,400,403)
Security.evtx (Event ID: 4688)
System.evtx (Event ID: 7045)

LogMeIn

MFT%LocalAppData%¥LogMeIn¥*%ProgramData%¥LogMeIn¥*%ProgramData%¥LogMeIn¥LMIyyyymmdd.log%ProgramData%¥LogMeIn¥LogMeIn.log%ProgramData%¥Microsoft¥Windows¥Start Menu¥Programs¥
LogMeIn Control Panel.lnk%ProgramFiles(x86)%¥LogMeIn¥*

LogMeIn

Registry

HKLM¥SOFTWARE¥LogMeIn¥V5¥FeatureHistory¥remotecontrol
HKLM¥SOFTWARE¥LogMeIn¥V5¥WebSvc¥Shared¥<random>
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥System¥CurrentControlSet¥Services¥LMIGuardianSvc
HKLM¥System¥CurrentControlSet¥Services¥LMIInfo
HKLM¥System¥CurrentControlSet¥Services¥LMIMaint
HKLM¥System¥CurrentControlSet¥Services¥LMIRfsDriver
HKLM¥System¥CurrentControlSet¥Services¥LogMeIn

LogMeIn

Event Log

Application.evtx (Event ID: 102, 105, 202, 205, 1033, 11707)
Security.evtx (Event ID: 4688)
System.evtx (Event ID: 7045)

AnyDesk

Registry

HKLM¥System¥CurrentControlSet¥Services¥AnyDesk

AnyDesk

Event Log

Security.evtx (Event ID: 4688)
System.evtx (EventID: 7045)

Atera

MFT

%ProgramFiles%¥Atera Networks¥*%ProgramFiles%¥ATERA Networks¥AteraAgent¥Packages¥
AgentPackageRunCommandInteractive¥log.txt%ProgramFiles(x86)%¥Atera Networks¥*%windir%¥Temp¥AteraSetupLog.txt

Atera

Registry

HKLM¥Software¥Atera Networks¥AlphaAgentHKLM¥System¥CurrentControlSet¥Services¥AteraAgent

Atera

Event Log

Application.evtx (Event ID: 0, 1033, 11707)
Microsoft-Windows-PowerShell/Operational.evtx (Event ID: 4104)
Windows PowerShell.evtx (Event ID: 400)
Security.evtx (Event ID: 4688)
System.evtx (Event ID: 7045)

183 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Artifacts Summary (RMM)
Tool

Category

Artifacts

Tool

Category

Artifacts

Ngrok

MFT

%LOCALAPPDATA%¥ngrok¥ngrok.yml

Splashtop

MFT

Ngrok

Event Log

Microsoft-Windows-RemoteDesktopServicesRdpCoreTS/Operational.evtx (EventID: 131)
Microsoft-Windows-TerminalServicesLocalSessionManager/Operational.evtx (Event ID: 25)
Security.evtx (Event ID: 4624, 4688)%ProgramFiles(x86)%¥Splashtop¥*%LOCALAPPDATA%¥Splashtop¥*%ProgramData%¥Splashtop¥*%ProgramData%¥Splashtop¥Temp¥log¥FTCLog.txt%ProgramFiles(x86)%¥Splashtop¥Splashtop Remote¥Server¥log¥SPLog.txt

Splashtop

Registry

HKLM¥SOFTWARE¥WOW6432Node¥Splashtop Inc.¥Splashtop Remote Server¥
ClientInfo
HKLM¥System¥CurrentControlSet¥Services¥SplashtopRemoteService
HKLM¥System¥CurrentControlSet¥Services¥SSUService

Splashtop

Event Log

Application.evtx (Event ID: 1033, 11707)
Security.evtx (Event ID: 4688)
Splashtop-Splashtop Streamer-Remote Session Operational.evtx(Event ID: 1, 200, 1000, 1001, 1100, 1101)
System.evtx (Event ID: 7045)

SupRemo

MFT%ProgramFiles(x86)%¥Supremo¥*%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.Client.log%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.FileTransfer.log%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.Incoming.log%ProgramData%¥SupremoRemoteDesktop¥Log¥Supremo.00.ReportsQueue.log%ProgramData%¥SupremoRemoteDesktop¥Log¥SupremoService.00.Service.log

SupRemo

Registry

HKLM¥System¥CurrentControlSet¥Services¥SupremoService

SupRemo

Event Log

Security.evtx (Event ID: 4688)
System.evtx (Event ID: 7045)

RemoteUtilities

MFT%ProgramFiles(x86)%¥Remote Utilities - Host¥Logs¥rut_log_yyyymm.html%APPDATA%¥Remote Utilities Agent¥Logs¥rut_log_yyyy-mm.html

RemoteUtilities

Registry

HKLM¥Software¥Usoris¥Remote Utilities¥Host¥Parameters¥*
HKLM¥System¥CurrentControlSet¥Services¥RManService
HKCU¥Software¥Usoris¥Remote Utilities¥Host¥Parameters¥*

RemoteUtilities

Event Log

Security.evtx (Event ID: 4688)
System.evtx (Event ID: 7045)

184 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Artifacts Summary (RMM)
Tool

Category

Artifacts

Tool

Category

Artifacts

TeamViewer

MFT%ProgramFiles%¥TeamViewer¥*%ProgramFiles%¥TeamViewer¥Connections_incoming.txt%ProgramFiles%¥TeamViewer¥TeamViewer15_Logfile.log%ProgramFiles%¥TeamViewer¥TVNetwork.log%ProgramFiles(x86)%¥TeamViewer¥*%ProgramFiles(x86)%¥TeamViewer¥Connections_incoming.txt%ProgramFiles(x86)%¥TeamViewer¥TeamViewer15_Logfile.log%ProgramFiles(x86)%¥TeamViewer¥TVNetwork.log%LOCALAPPDATA%¥TeamViewer¥TVNetwork.log%TEMP%¥TeamViewer¥*%TEMP%¥TeamViewer¥TV15Install.log%TEMP%¥TeamViewer¥tvinfo.ini

TightVNC

MFT%ProgramData%¥Microsoft¥Windows¥Start Menu¥Programs¥TightVNC%ProgramData%¥TightVNC%ProgramFiles%¥TightVNC%ProgramFiles(x86)%¥TightVNC

Registry

HKCU¥Software¥GlavSoft LLC.¥TightVNC1*HKCU¥Software¥TightVNC¥Server
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥TightVNC
HKLM¥SYSTEM¥CurrentControlSet¥Services¥tvnserver

Event Log

Application.evtx (Event ID: 257, 1033, 11707)
Security.evtx (Event ID: 4688)
System.evtx (EventID: 7045)

Registry

HKCU¥Software¥TeamViewer
HKLM¥SOFTWARE¥TeamViewer
HKLM¥SOFTWARE¥WOW6432Node¥TeamViewer
HKLM¥SOFTWARE¥WOW6432Node¥TVInstallTemp
HKLM¥SYSTEM¥CurrentControlSet¥Services¥TeamViewer

Event Log

Security.evtx (Event ID: 4688)
System.evtx (EventID: 7045)

185 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.

Artifacts Summary (SYNC)
Tool

Category

Artifacts

Tool

Category

Artifacts

FileZilla

MFT%APPDATA%¥FileZilla¥filezilla.xml%APPDATA%¥FileZilla¥recentservers.xml%ProgramData%¥Microsoft¥Windows¥Start Menu¥Programs¥FileZilla
FTP Client%ProgramFiles%¥FileZilla FTP Client¥

Megatools

MFT%Temp%<random>.megatools.cache<same directory as megatool.exe>¥mega.ini

Megatools

Event Log

Security.evtx (Event ID: 4688)

RcloneMFT%APPDATA%¥rclone¥rclone.conf

RcloneEvent Log

Security.evtx (Event ID: 4688)

WinSCP

MFT%ProgramFiles(x86)%¥WinSCP¥*%USERPROFILE%¥AppData¥Local¥Programs¥WinSCP¥*WinSCP

Registry

HKCR¥winscp-*
HKCU¥Software¥Martin Prikryl¥WinSCP 2
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP 2¥Configuration¥CDCache
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP
2¥Configuration¥LastFingerprints
HKCU¥SOFTWARE¥Martin Prikryl¥WinSCP 2¥Sessions¥*
HKLM¥SOFTWARE¥Martin Prikryl¥WinSCP 2
HKLM¥SOFTWARE¥WOW6432Node¥Martin Prikryl¥WinSCP 2WinSCP

Event Log

Security.evtx (Event ID: 4688)

FileZilla

Registry

HKLM¥SOFTWARE¥WOW6432Node¥FileZilla Client¥*

FileZilla

Event Log

Security.evtx (Event ID: 4688)

FreeFileSync

MFT%APPDATA%¥FreeFileSync¥GlobalSettings.xml%APPDATA%¥FreeFileSync¥GoogleDrive¥<GoogleDrive account>.db%APPDATA%¥FreeFileSync¥LastRun.ffs_gui%APPDATA%¥FreeFileSync¥Logs¥[Last session] yyyy-mm-dd
hhmmss.SSS*.html%ProgramFiles%¥FreeFileSync¥*%ProgramFiles(x86)%¥FreeFileSync¥*

FreeFileSync

Registry

HKLM¥SOFTWARE¥WOW6432Node¥FreeFileSync

FreeFileSync

Event Log

Security.evtx (Event ID: 4688)

GoodSync

MFT%LOCALAPPDATA%¥GoodSync¥GoodSync-<yymmdd>-<hhmm>.log%LOCALAPPDATA%¥GoodSync¥InstallLicense-yymmdd-hhmm.log%LOCALAPPDATA%¥GoodSync¥server-accounts.tic%ProgramData%¥Siber Systems¥GoodSync¥*

GoodSync

Registry

HKLM¥System¥CurrentControlSet¥Services¥GsServer

GoodSync

Event Log

Security.evtx (Event ID: 4688)
System.evtx (EventID: 7045)

186 | Copyright © 2023 Trend Micro Incorporated. All rights reserved.