Install Script Overview

Owned by Noah Greenberg
Apr 18, 2024

  1. The latest installer is downloaded from https://installerfiles.rpp.cybercrucible.com/installers/64/installer-cli.exe

    1. PowerShell (PS1) install scripts will use a WebClient instance.
      image-20240418-180132.png

    2. Batch (BAT) install scripts will use BitsAdmin, or JScript if BitsAdmin fails.
      image-20240418-175009.png

  2. Installer is executed and passed the group ID and client authentication provided in your script.

  3. Installer checks for required installation conditions

    1. Running with Administrator privileges.

    2. The machine is running a supported version of Windows.

    3. There is not another installer already running.

    4. The agent is not already installed.

  4. Installer checks that the machine can communicate with the required servers.

    1. Amazon oAuth 2.0 at ransomwarerewind-agents.auth.us-west-2.amazoncognito.com

    2. Cyber Crucible backend at agent.tasking.rpp.cybercrucible.com

  5. Agent files are downloaded from installerfiles.rpp.cybercrucible.com over HTTPS.

  6. The agent is installed and started.